Eliminating the Barriers: Demystifying Wi-Fi Baseband Design and Introducing the PicoScenes Wi-Fi Sensing Platform

10/20/2020 ∙ by Zhiping Jiang, et al. ∙ 0

Research on Wi-Fi sensing over the past decade has been thriving, but not smooth. Three major barriers severely hamper the research, namely, the unknown baseband design and its influence on CSI, inability to access the low-level hardware controls and the lack of a flexible and versatile software toolkit for hardware control. This paper tries to break the above three barriers from the following aspects. First, an in-depth study on the baseband design of QCA9300, the popular CSI-enabled Wi-Fi NIC, is presented. The lessons learned is of great guiding significance for understanding what other commercial off-the-shelf NICs. Second, several valuable features of QCA9300 are unlocked for research, such as the arbitrary tuning for both the carrier frequency and baseband sampling rate. By leveraging the unlocked features, we identify three important types of CSI distortion, and pinpoint their origin through extensive evaluations. Last, we develop and release PicoScenes, a powerful, hardware-unified and extensible Wi-Fi sensing system. PicoScenes allows direct access to the unlocked features of QCA9300 and IWL5300, and therefore greatly facilitate the research on Wi-Fi sensing. It also supports the SDR-based Wi-Fi sensing by embedding a 802.11a/g/n/ac/ax software baseband implementation. We release PicoScenes at https://zpj.io/ps.



There are no comments yet.


page 1

page 13

page 14

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

I Introduction

After a decade of advancement, Channel State Information (CSI) based Wi-Fi sensing has grown into a thriving and fruitful research field, and has led to new areas of sensing research, such as passive gesture recognition [12] [29] [5], motion tracking [23], respiration detection [2] [41], through-wall detection [11], sign language recognition [21] [19], etc.

However, the 10 year development of Wi-Fi sensing research has not been smooth, and has always been hampered by some basic issues: first, there lacks the first-hand knowledge on the modern Wi-Fi chip architectures; the interpretation of CSI we rely on mostly comes from the OFDM textbooks that are out of touch with actual chip design; for many unexplainable measurements, we cannot give well-founded explanations. Second, despite that the researchers claim that the access to CSI data will be standardized in future commercial off-the-shelf (COTS) Wi-Fi NICs, after 10 years, we still use the old NIC models, and CSI data can only be accessed by loading modified firmwares [10, 9] or by accessing the undocumented hardware register [34]. Third, there is a sharp contrast between the under-functional measurement software and the rapid development of Wi-Fi sensing research. Behind each experiment are cumbersome jobs of measurement, data collection, data alignment, and even the development of a specialized measurement software. We summarize these issues as three key barriers that need to be addressed.

Barrier 1: Unknown hardware baseband design and its influence on CSI. In Wi-Fi sensing field, the widely accepted CSI model is as follows.


where Eq. 1 describes that the baseband channel frequency response, , transforms the Tx baseband signal which is perfectly aligned with the modulation constellation, , into the received version . Eq. 2 is the extensively adopted interpretation in Wi-Fi sensing field, which further decomposes into two terms, where denotes the linear phase error component which is mainly caused by the Tx/Rx un-synchronization, and denotes the in-air wireless channel response which is the key component for Wi-Fi sensing.

Fig. 1: CSI measurement from IWL5300 and QCA9300 in radio anechoic chamber. The magnitude response shows the M-shaped frequency-selective fading and the phase response shows the lying S-shaped non-linear delay.

Apparently, Eq. 2 implicitly assumes that the Wi-Fi hardware has a flat frequency response with merely a linear phase error component. The real-world experiments, however, do NOT support this assumption. We put Intel Wireless Link 5300 NIC (a.k.a IWL5300 thereafter) and Qualcomm Atheros 9300 (a.k.a QCA9300 thereafter) in radio anechoic chamber and measured the CSI from both NICs. As depicted in Fig. 1, the CSI measurements show M-shaped magnitude response and lying S-shaped phase response which are far different from what we expected. We also measure the CSI in a variety of position/frequency configurations, but achieving the similar results. The only possible explanation to the strange measurement is that, an unknown CSI distortion exists in between the Tx and/or Rx process. This distortion is apparently a contamination to , Several works [34, 46, 27] trying to explain the distortion, however they ignore the magnitude distortion and also the asymmetrical phase distortion in HT40+/ cases.

Barrier 2: inability to access the low-level controls.

The existing CSI tools cannot meet researchers’ requirements on the Wi-Fi sensing configurations. On the hardware side, the inability to access the low-level hardware features, e.g. tuning for carrier frequency and bandwidth, antenna control, spatial mapping etc, greatly hinders the development of more advanced Wi-Fi sensing research. In addition, the information returned by COTS NICs receiver is not sufficient for modern Wi-Fi sensing. Some valuable PHY-layer information are hidden by the hardware, such as the CSI measured from L-LTF (legacy long training field), demodulated data symbols, and scrambler initial value.

As an alternative, SDR-based Wi-Fi implementation are used in literature [37, 4, 44] for complete control over low-level details. However, in addition to the expensive hardware, the steep learning curves, in-depth involvement in OFDM or broadband communications, and, crucially, the lack of publicly available baseband SDR implementations, are real barriers to the application of SDR-based Wi-Fi sensing.

Barrier 3: The lack of a flexible and versatile software toolkit for Wi-Fi sensing. On the software side, as the research advances, researchers expect to perform more advanced and complex measurement, such as the collaborative measurement between Tx and Rx, round-trip measurement, synchronized channel scanning and Tx beamforming etc. To meet these requirements, the measurement program needs to integrate both the Tx frame generation/injection and in-situ CSI parsing. In addition, the program should have an extensible architecture to be flexible to various of the measurement requirements. However, the companion programs of the existing CSI tools are merely data loggers, and don’t support the above objectives architecturally.

This paper tries to eliminate the above barriers through three works. First, based on the the public documents, we piece together a detailed architecture of the QCA9300 baseband design, especially its carrier frequency/baseband sampling design, baseband filters, and its register-based control mechanism. Based on the exploration, we unlock some valuable features, including the arbitrary tuning for both carrier frequency and baseband sampling rate, etc.

Leveraging these features, we evaluate the impact of various of channel configurations on CSI distortion, and identify that the bandwidth is the one of the most influential factors affecting the CSI distortion. It eventually leads us to the conclusion that the CSI distortion is caused by baseband filtering. The evaluations also clearly show that the CSI measurement from both IWL5300 and QCA9300, and even from all Wi-Fi hardware, are substantially affected by the baseband filtering in terms of magnitude and phase responses.

At last, we develop a versatile Wi-Fi sensing system, PicoScenes. It supports IWL5300, QCA9300 and even software-defined radio (SDR). The unlocked features of IWL5300 and QCA9300 are accessible right away on PicoScenes. To support SDR hardware, PicoScenes embeds a high performance software-defined radio (SDR) implementation for 802.11a/g/n/ac/ax. It supports multi-user MIMO (MU-MIMO), beamforming, and OFDMA.

Our contributions are summarized as follows.

First, this is, to the best of our knowledge, the first in-depth study of COTS Wi-Fi NIC baseband hardware design ever since the beginning of CSI-based Wi-Fi sensing. The lessons we’ve learned from QCA9300 design are of great guiding significance for speculating what happen on other confidential platforms, such as IWL5300 or BroadCom 43xx series (a.k.a BCM43xx thereafter) [9].

Second, we unlock some of QCA9300’s most valuable hardware features and make them public, such as the arbitrary tuning for both carrier frequency and baseband sampling rate. As far as we know, this is also the first work that unlocks the ultra-wide spectrum access on COTS Wi-Fi NIC. There is no doubt that its UWB spectrum access will push the limit of Wi-Fi sensing accuracy and resolution to higher standards.

Third, this is also the first work that identifies the pervasiveness of the CSI distortion and locates its origin through extensive experiments and baseband analysis. We identify three types of CSI distortion and their trigger conditions. We also propose a reliable solution to remove those distortion.

Last, we release PicoScenes system, a powerful, multi-hardware supporting and user extensible Wi-Fi sensing platform. PicoScenes fully unleashes the potential of QCA9300 along with IWL5300. It also embeds a high-performance software implementation of 802.11a/g/n/ac/ax baseband processing, which is an out-of-the-box solution for SDR to transmit and receive the 11a/g/n/ac/ax rate packets, measure CSI and obtain much richer PHY layer information than on COTS platform.

The rest of the paper is organized as follows. Section II briefly reviews the recent works on Wi-Fi sensing. Section III presents the in-depth study of the baseband design for QCA9300. Section IV goes deep into the CSI distortion. Section V introduce the PicoScenes Wi-Fi sensing system. At last, Section VI concludes the paper.

Ii Related Work

In this section, we briefly review the recent works on Wi-Fi sensing from two perspectives:

  1. [leftmargin=*]

  2. the approaches adopted in literature;

  3. the hardware used in the literature.

Fig. 2: Number of Wi-Fi sensing related publications during the past 10 years.

Ii-a Wi-Fi sensing, model-based v.s learning-based

Model-based Wi-Fi sensing [22] has made remarkable advancement after 10 years of development, and has led to many new research areas of fine-grained sensing, including indoor localization [18, 38, 45, 35], trajectory tracking [15, 6, 17], material identification [8], hand gesture recognition [33], inertial measurements [31], etc. mDTrack [35]

proposes a joint approach to estimate angle of arrival (AoA), time of flight (ToF) and Doppler effect simultaneously, achieving the decimeter-level resolution for indoor localization. Nopphon et al. 

[15] extract Doppler frequency from CSI, and use it to track the hand trajectory with centimeter-level accuracy. WiMi [8] proposes a sophisticated system that can identify the type of materials regardless of its motion state. WiWrite [33] observes the different signal reflection patterns caused by different hand gestures, and proposes a method to realize precise character recognition and word estimation. RIM [31] is the latest work focusing on the inertial measurement for the sake of tracking moving distance, heading direction and rotating angles. It leverages the phase difference between antennas to infer the moving direction and speed. Recently, respiration monitoring becomes a hot topic. RespiRadio [25] and MultiSense [40] propose the respiration sensing for single-person and multi-people, respectively.

Learning-based Wi-Fi sensing [32]

has reached unprecedented precision and sensing capability in traditional areas, with the rapid development of machine learning, especially deep learning. It has also derived many new research areas, such as daily behavior recognition 

[30, 16], falling detection [28], hand gesture recognition [19, 1], etc. CARM [30] can precisely correlate CSI dynamics with specific human activities by simultaneously employing CSI-speed and CSI-activity models. Rt-fall [28]

constructs a real-time, contactless and low-cost system to segment and detect like-fall behaviour according to a new feature extraction method. Wifinger 

[19] has achieved a continuous number text input prototype which is capable of recognizing the different patterns of hand gestures. RF-Pose [42] and RF-Pose3D [43]

propose through-wall human pose estimation systems. For each each individual, it localizes and tracks their body parts head, shoulders, arms, wrists, hip, knees, and feet.

Fig. 3: A rough statistics of

As shown in Fig. 2, we make a statistics about what approaches the Wi-Fi sensing system adopt. It is shown clearly that, in terms of the number of publication per year, learning-based Wi-Fi sensing has outpaced the model-based approaches since 2016. In our view, there are three reasons behind it. First, the learning-based approach fully takes advantage of the deep learning technology, and the end-to-end development model reduces barriers to Wi-Fi sensing research. Second, after the first 5 years of understanding wireless communication and CSI, the barrier to model-based sensing are rising rapidly. Third, due to the Barrier 1 and 2 previous discussed in Section I, precise sensing is severely hindered by the old hardware and unknown baseband distortion.

Fig. 4: QCA 9300 transceiver architecture. TX and Rx flow is highlighted in red and blue respectively. For simplicity, this figure shows only one of the three MIMO transceiver chains.


We make another rough statistics about the devices used by researchers in all CSI-based research works, as shown in Fig. 3. The IWL5300 is the most widely used NICs for CSI extraction [18, 17, 31]. This NIC works with common laptop and user can carrier out CSI-measurement easily. The second is QCA9300[34, 36, 31], which reports CSI with 10-bit resolution and uncompressed subcarriers. However, Atheros CSI Tool prioritizes the development of router version, which is less convenient for Wi-Fi sensing. Nexmon CSI Extractor [9, 47] is the latest update to the list of CSI-ready devices. It is based on Broadcom 43xx series chip, which has be equipped in several Android smart phones, Raspberry models, and some Wi-Fi Routers. The inability to access the low-level hardware control is a barrier to more advanced Wi-Fi sensing research, however, SDR-based CSI extraction is even harder[37, 4, 44]. USRP, WARP or other SDR hardwares are merely the RF frontend, and the lack of the Wi-Fi software implementation is the fatal problem.

Iii QCA9300 Hardware Architecture

In this section, we describe the hardware design of QCA9300 NIC. We first present the general architecture, then we focus on 3 design highlights, which are valuable for Wi-Fi sensing application and research. At last, we briefly discuss what we’ve learned from QCA9300 and try to infer how other Wi-Fi NICs work.

Iii-a The Architecture of QCA9300

Detailed baseband design is the key to peering into Wi-Fi hardware and revealing what process the signal goes through. Unfortunately, chipmakers disclose these core business secrets only to the authorized customers with NDA agreement signed, and all CSI-ready COTS NICs are subject to similar technical confidentiality, such as IWL5300, QCA9300, BCM43xx.

Fortunately, Atheros has a good publication record before it was acquired by Qualcomm [39, 24, 3, 13]

. Based on these public documents and our in-depth study of QCA9300’s open-source driver (codenamed

ath9k [20]), we piece together a detailed QCA9300 baseband design as shown in Fig. 4. For the sake of simplicity, this diagram shows only one of the three transceiver chains and focuses on the frontend design.

The baseband consists of several key components, namely Digital Baseband, Analog Baseband, and Analog Passband.

Digital Baseband

deals with the OFDM communication, such as Fast Fourier Transformation (FFT) and inverse FFT (IFFT) pair, cyclic prefix insertion/removal, and packet detection, BCC/LDPC encoding, modulation, interleaving,


On the boundary between the digital baseband and the analog baseband, lay a pair of analog digital conversion (ADC) and digital analog conversion (DAC).

Analog Baseband mainly copes with the sampling and filtering. The 40MHz crystal oscillator drives the Baseband phase-locked loop (PLL), which feeds different frequencies to DAC and ADC, both of which are several times higher than the signal. This somewhat strange clocking plan will be detailed later. Both BIQUAD1 and BIQUAD2 are active-RC low pass filters with runtime reconfigurability, and BIQUAD1 is shared between Tx and Rx paths. In Tx path, the notch filter, BIQUAD1 and voltage to current converter (V2I) form a second-ordered Butterworth filter. This filter serves as the reconstruction filter which removes the spectral images caused by DAC. In Rx path, the current to voltage converter (I2V), BIQUAD1 and BIQUAD2 form a fifth-ordered Butterworth filter. This filter is primarily used as the pre-ADC anti-aliasing filter but also as the adjacent channel rejection (ACR) filter.

Analog Passband is primarily in charge of the synthesis of carrier frequency, up/down frequency conversion, power amplification of Tx and Rx paths, and switching control of the antenna. The QCA9300 generates carrier frequencies for both 2.4GHz and 5GHz bands from a single synthesizer. This smart design will also be detailed later.

Iii-B Major Design Highlights of QCA9300

Due to the page limit, here we only discuss three of the most valuable designs for Wi-Fi sensing.

Iii-B1 Highly configurable soft-MAC architecture

Because QCA9300 is a soft-MAC NIC, ath9k driver has complete control over the NIC through a large number of control registers provided by the hardware. For instance, Atheros CSI Tool[34] forces the hardware to report per-packet CSI by specifying 1 to the 28th bit (H_TO_SW_DEBUG_MODE) of the control register 0x8344 (AR_PCU_MISC_MODE2). These control registers can even be accessed by user-space programs. Taking advantage of this feature, PicoScenes exposes a number of proprietary hardware controls, such as the controls for carrier frequency and sampling rate, which are detailed as follows.

Iii-B2 Wide-range and user-tunable baseband clocking

The clocking architecture is one of the most highlighted designs in QCA9300, as shown in Fig. 5. The 40MHz crystal oscillator, denoted by ‘40MHz xtal.’ in the figure, derives two branches. One goes into the Baseband phase-locked loop (PLL) to drive the entire baseband, and the other is fed into the RF Frequency Synthesizer to generate the carrier frequency for 2.4GHz and 5GHz bands. Here we focus on the baseband branch first.

Although the baseband generate and decodes the Wi-Fi baseband signal which is with 20MHz or 40MHz bandwidth, the actual Baseband clocking is much more complicated than just two operating frequencies. The Baseband PLL derives a group of matched clocks to drive different parts of the baseband circuit. Even more confusing is that many of the frequencies have another “paired” frequency of , such as 80/88MHz, 160/176MHz, etc. The reasons behind this complex design are worth knowing.

There are three main challenges motivating this clocking design. The first is to overcome the imperfection of digital-analog converter (DAC) in Tx baseband. DAC, by its very nature, cannot perfectly reconstruct analog signals, because the produced stair-stepped waveform creates both in-band sinc fading as well as the out-of-band spectral “images” [26] which repeats the in-band signal spectrum at every multiple of the sampling frequency. These two distortions violate both the spectral flatness and spectral mask requirements set out in the 802.11 standard [14]. To remove the images, an anti-image filter, or reconstruction filter, usually follows the DAC. Since the transition zone is narrow, the filter should be with high order, however, the latter is rarely used in IC design, because it takes up large IC area and is with high power consumption.

QCA9300 addresses this problem by oversampling. In QCA9300, DAC operates at 160MHz, 8x higher than the 20MHz signal bandwidth. According to the Sampling Theory [26], 8x oversampling leads to 8x stretched sinc fading. In this way, the in-band spectrum is flat, and it meets the flatness requirement. The 8x oversampling also results in 8x stretched spectral images, therefore expands the transition zone left for the reconstruction filter, which in turn reduces the order of the filter. As shown in Fig. 4), the combination of a second-order LPF is good enough to suppress the spectral images.

Fig. 5: The clocking hierarchy of QCA9300. The 40MHz crystal derives two clocking branches. RF Frequency Synthesizer is detailed in Section III-B3, while Baseband PLL generates multiple matched clocks for the baseband components. The values in () is that frequency when fastclock option is on.

The second challenge is the power consumption. Pursuing the power efficiency, the Baseband PLL generate 3 levels of sub-frequencies. Tx DAC runs at the highest frequency, i.e. =160MHz; Rx ADC runs at the medium frequency, i.e. =80MHz; and the digital baseband runs at the lowest frequency, i.e. =40/80MHz according to whether the 802.11n channel bonding feature is on.

The third challenge is the backward compatibility with 802.11b standard. In the 2.4GHz band, the NIC has to support 802.11b/g/n standards at the same time, but the 22MHz bandwidth of 802.11b is incompatible with the 20 or 40MHz bandwidth of 802.11g/n.

QCA9300 adopts multi-rate design to simultaneously accommodate 802.11b/g/n protocols in the 2.4GHz band [24, 13]. QCA9300 boosts , , and by 1.1x to 44/88/176MHz. For 802.11b packets, the frequency gap between =44MHz and 22MHz bandwidth is bridged by a pair of frequency divider and 2x frequency multiplier. For 802.11g/n case, as shown in Fig. 4, QCA9300 uses a pair of

sequencing interpolator and decimator to bridge the 44MHz and 40MHz gap. It is worth noting that, for some later models of QCA9300, such as QCA9380/9390/9590, there is a

fastclock option (ON by default) which specifies the 44/88/176MHz clocks for both 2.4/5GHz bands.

Down to the specific control, , and are collectively derived from the core baseband PLL clock . ath9k uses a parameter quadruple to tune , i.e. (DIV_INT, REF_DIV, CLK_SEL and HT20_40). With some reverse engineering, we learn how to tune and its derived clocks as follows.


where =40MHz is the frequency of the core crystal oscillator. In the 2.4GHz band, the parameter quadruples for 802.11n HT20 and HT40 Channel Modes are (44, 5, 0, 0) and (44, 5, 0, 1), respectively. Bringing them into Equation 3, we have 88MHz or 176MHz for , and 44/88/176MHz or 88/176/342MHz for , and , respectively. The PLL clock controls the pace of entire digital baseband, therefore, tuning is equivalently to tune the channel bandwidth. TABLE I lists some of integral channel bandwidths calculated from the quadruple combinations. Despite an incomplete list of the supported bandwidths, QCA9300, a Wi-Fi NIC designed more than a decade ago, is still surprising that it can scale the bandwidth from as low as 2.5MHz to 80MHz. PicoScenes has integrated the bandwidth tuning for QCA9300, allowing users to specify the bandwidth using only one parameter “-rate”.

quadruple except HT_2040 HT_2040 = 0 HT_2040 = 1
(22, 10, 1) 2.5MHz 5MHz
(22, 10, 0) 5MHz 10MHz
(22, 5, 1) 5MHz 10MHz
(22, 5, 0) 10MHz 20MHz
(33, 5, 0) 15MHz 30MHz
(44, 5, 0) 20MHz 40MHz
(88, 5, 0) 40MHz 80MHz
TABLE I: Bandwidth by quadruple parameters

Iii-B3 Wide-range and user tunable carrier frequency synthesizer

As shown in Fig. 6, QCA9300 uses a shared frequency synthesizer to generate the carrier frequency for both 2.4GHz and 5GHz bands. The frequency synthesizer is a voltage controlled oscillator (VCO) based synthesizer with the operating range from 3.0GHz to 4.0GHz.

The 2.4GHz band frequency synthesizing plan is illustrated in the lower part of Fig. 6. The synthesizer operates around 3.2GHz, i.e. GHz. To generate 2.4GHz carrier frequency, is first mixed with a half of itself, i.e. 1.6GHz, producing 4.8GHz signal, and then 4.8GHz signal divided by 2 to produce the 2.4GHz carrier frequency.

Fig. 6: QCA9300’s synthesizing plan for the carrier frequency. An integrated Integer/Fractional-N synthesizer is shared in both 2.4/5GHz bands but with different frequency conversion paths.

The 5GHz band frequency synthesizing plan is illustrated in the upper part of Fig. 6. In this band, the synthesizer operates around 3.4GHz to 4GHz. Taking the down-conversion of 5.4GHz Rx signal, for instance, the synthesizer operates at 3.6GHz, i.e. GHz. The 5.4GHz Rx signal is first down-converted to an intermediate frequency (IF) at 1.8GHz by mixing with . Then the IF signal is down-converted again, but by mixing with a half of , i.e. 1.8GHz. In this way, the signal is dual-converted to the baseband.

Actually supported range(GHz) 3.0-4.0 2.25-3.0 4.5-6.0
Minimal tuning resolution(Hz) 305.2 203.3 915.5
TABLE II: Carrier frequency supported by QCA9300

Down to the specific control, with some reverse engineering, we learn how to tune the synthesizer as follows.


where CHANSEL is an unsigned integer variable used for tuning , and and are the output carrier frequencies in 2.4GHz or 5GHz bands, respectively. Bringing CHANSEL=1 into Eq. 7, we obtain the minimal tuning step of synthesizer that, Hz. In addition, bringing the working range of synthesizer into Eq. 8, we have TABLE II which summarizes the maximum working ranges and resolutions supported by QCA9300. PicoScenes has also integrated the carrier frequency tuning for QCA9300, allowing users to specify it using only one parameter “-freq”.

Iii-C What do we learn from QCA9300?

QCA9300 provides us great guiding significance to speculate how other Wi-Fi NICs work. Due to the page limit, we only discuss the following three key points which are common to ALL NICs of all brands or vendors.

The first is about the influence of the baseband filter. Due to the spectral flatness and masking requirements of 802.11 standard, ALL NICs, add strong filters before and after the DAC/ADC pair. It is no doubt that these filters exert certain influences on the baseband signal, certainly including the CSI. In this case, we must re-evaluate the correctness of the extensively accepted CSI model shown in Eq. 2, which assumes the influence of baseband hardware is just a linear phase offset.

The second is about the sampling time. Phase-based Wi-Fi sensing is sensitive to Symbol Timing Offset (STO), which is always an integer multiple of the sampling time. However, the sampling time does vary depending on the hardware. Previous works assumed that the hardware samples at 50ns intervals, i.e. 20MHz sampling rate. However, it is not correct. On QCA9300, Tx and Rx operate at 160/176MHz and 80/88MHz. On USRP N210 and X310 models, the entire baseband run at 100MHz or 200MHz111This is actually the “masterclock” rate of USRP hardware, and X310 can specify multiple masterclock rates., respectively. For IWL5300, we also suspect that its baseband runs at 40MHz.

The third is about the carrier frequency offset. Most of modern NICs use integer/fractional- synthesizer to generate the carrier frequency. However, as suggested in Eq. 7, the synthesizer does have the minimum tuning resolution, so, the synthesizer cannot precisely tune to certain given frequencies. Still taking QCA9300, for example, if we specify a frequency of 5.2GHz, the NIC is actually specified to operate at 5199.999389MHz or 5200.000305MHz. This small frequency offset is perfectly acceptable in Wi-Fi communication or most Wi-Fi sensing applications, however, if regarding Doppler effect, it cannot be ignored. Unfortunately, the tuning resolution depends highly on the baseband design, and we currently only have detailed clocking architectures for QCA9300 and USRP models.

Iv Revealing The Pervasive CSI Distortion

Fig. 7: Hardware setup for CSI distortion evaluation.

In this section, we examine the CSI distortion under various of channel configurations, and experimentally pinpoint the most probable origin of the distortion. Then, we explain what the distortion is and its cause. At last, we propose an reliable method to eliminate the distortion.

Iv-a Where does the CSI distortion come from?

We design 5 tests to identify the origin of the distortion.

Test setup

Two laptops equipped with both QCA9300 and IWL5300 NICs are used in the tests. As shown in Fig. 7, NICs on two laptops are connected by the double-shielded coaxial cable (RG142) and fixed attenuators. During the tests, we use PicoScenes software to control the packet injection-based transmission and reception, and also shut down their second and third radio chains to prevent the undesired maximal ratio combining (MRC).

Fig. 8: CSI distortion under different Rx NIC-Channel Mode combinations.

Iv-A1 T1: test for the influence of Rx baseband

In this test, the QCA9300 NIC installed in laptop A injects HT-rate packets at the 2432MHz channel. Both QCA9300 and IWL5300 NICs installed in laptop B receive the packets but under 3 different Channel Modes, namely HT20, HT40+ and HT40-. Therefore, we have a total of 6 NIC-Channel Mode combinations. Fig. 8 shows the average magnitude and phase of the received CSI.

Before the analysis, let’s recap the 802.11n Channel Mode briefly. HT20 or HT40+/- refers to the HT format 20MHz or 40MHz channel. The latter doubles the bandwidth to subsume an adjacent channel which is with higher or lower carrier frequency, meanwhile it shifts the carrier frequency to the center of the merged channel. HT40+/- mode can also communicate with HT20 channel, transmitting data in only half of its total bandwidth and filling the other half with 0. Fig. 8 shows three key observations of the distortion.

  1. [leftmargin=*]

  2. the CSI difference shown in Fig. 8 can only be attributed to the Rx baseband and the NIC-Channel Mode combination, as the Tx end and the cable connection remain unchanged during the test.

  3. in HT20 Channel Mode, both NICs exhibit roughly symmetrical distortions. The magnitude and phase show M-shaped distortion and the lying S-shaped distortion, respectively. Both distortions are strong and we cannot ignore them.

  4. in HT40+/- Channel Modes, both magnitude and phase distortion are heavily biased, especially in the case of IWL5300. Interestingly, we find that the biased response (both magnitude and phase) is similar to the stretched version of the left or right half of the HT20 response.

Fig. 9: CSI distortion under Different Tx NIC-Channel Mode combinations.

Iv-A2 T2: test for the influence of Tx baseband

In this test, we swap the Tx and Rx rules. IWL5300 NIC installed in laptop A, as the Rx NIC222QCA9300 doesn’t report CSI for the packets sent from IWL5300, but the reverse works. So we use IWL5300 as Rx NIC in this test., operates at 2432MHz and HT20 mode and remains unchanged during the test. QCA9300 and IWL5300 NICs installed in laptop B transmit packets in each of the 3 Channel Modes. Fig. 9 shows the average magnitude and phase of the received CSI. We get the following key observations:

  1. [leftmargin=*]

  2. the CSI difference shown in Fig. 9 can only be attributed to the Tx baseband and the NIC-Channel Mode combination, because the Rx end and the cable connection remain unchanged during the test. This test actually reveals a long been ignored aspect of Wi-Fi sensing: the Tx signal actually emitted from antenna is not spectrum flat, whether magnitude or phase.

  3. Given the remarkably high similarity between Fig. 9 and Fig. 8, we speculate that, in both NICs, there may be shared stage(s) between the Tx and Rx signal flow. QCA9300’s baseband design supports this conjecture, that the filter BIQUAD1 is indeed shared between the Tx and Rx baseband flows as shown in Fig. 4.

  4. IWL5300 is worse than QCA9300 in terms of spectrum flatness and spectral mask. Especially in HT40+/- cases, IWL5300 shows over 10dB magnitude gap, in contrast, QCA9300 has a much better spectrum flatness than IWL5300 in both Tx and Rx cases.

Iv-A3 T3: test for the influence of I/Q mismatch

Fig. 10: CSI distortion under different I/Q mismatch configurations.

I/Q mismatch is a common imperfection of radio frontend which is reflected in two mismatches between the in-phase (I) and the quadrature (Q) of LO signal, namely the magnitude inequality and/or the phase non-orthogonality [7]. PicoScenes software can override the Rx I/Q imbalance configuration in the ath9k driver, which allows us to investigate the influence of I/Q mismatch. In this test, we use PicoScenes software to scan both the I/Q magnitude ratio and I/Q phase offset for the QCA9300 Rx end, whilst the Tx end injects packets continuously. Fig. 10 shows the average magnitude and phase of the received CSI.

Fig. 10 shows that I/Q mismatch creates some in-band CSI disturbance and overall translation of the magnitude. And it evidently shows that I/Q mismatch is NOT associated with CSI distortion.

Type No. Visual Form Symmetry Trigger Condition
Type 1 M-shaped magnitude, lying S-shaped phase Close to symmetrical BW 20MHz, both sides in HT20 or HT40 Channel Mode
Type 2 inverted V-shaped magnitude, straight line phase Close to symmetrical BW 20MHz, both sides in HT20 or HT40 Channel Mode
Type 3 Left or right half of Type 1 Asymmetrical Either side with HT40+/- Channel Modes
TABLE III: Types of CSI distortion
Fig. 11: CSI distortion under different Tx power.

Iv-A4 T4: test for the influence of Tx power

Similar to the previous test, we use PicoScenes to scan the transmission power of Tx side to access the influence of Tx power. Fig. 11 shows the average magnitude and phase of the received CSI.

It is clear from Fig. 11 that Tx power is also NOT associated with the CSI distortion. A strange phenomenon is that, as the Tx power increases, the CSI magnitude level drops unexpectedly. We believe this is caused by the Rx AGC, which throttles the excessively large signal to a lower level to prevent the ADC saturation.

Iv-A5 T5: test for the influence of bandwidth

In this test, we use PicoScenes to control the QCA9300 NICs on both Tx and Rx ends to scan the bandwidth from 5MHz to 55MHz with 5MHz spacing. Details of bandwidth tuning are previously described in Section III-B2. To the best of our knowledge, this is the first work that measures the CSI under different bandwidths on COTS NICs. Fig. 12 shows the average magnitude and phase of the received CSI. The results are just astonishing, and we get the following key observations:

  1. [leftmargin=*]

  2. The distortion shows the bandwidth-related shape altering. Specifically, as the bandwidth decreases, the magnitude response deforms from the M-shaped to the never seen inverted V-shaped, whilst the phase response deforms from the lying S-shaped to roughly a straight line.

  3. As bandwidth increases, we observe an increase in the curvature of both the M-shaped magnitude and the lying S-shaped phase distortion.

Summary of the test results

Based on the above analysis, we draw the following conclusions:

  1. [leftmargin=*]

  2. There are three types of distortion as listed in Table III.

  3. Among various of influence factors, bandwidth is the dominant one.

  4. Both Tx and Rx sides contribute to the distortion, whilst Rx end contributes more.

  5. The distortion is pervasive for all hardware, and in all channel configurations IWL5300 has even stronger distortion.

  6. Tx power and I/Q imbalance have NO influence on distortion.

Fig. 12: CSI distortion under different Tx-Rx bandwidths.

Iv-B What causes the distortion? Reasonable conjectures.

Despite the lack of official documents, we can make reasonable conjectures about the possible causes of the distortion, based on some widely accepted RF design principles.

Type 1 distortion is highly probable the combined effect of the Digital Predistortion (DPD) module and the Rx-end adjacent channel rejection (ACR) filter. PDP module intentionally bends Tx and Rx signal with the inverse sinc response to compensate or even over-compensate the sinc fading caused by the Tx DAC. In term of CSI distortion, the over-compensation effect corresponds to the V-shaped part which is in the center of the M-shaped distortion. It is worth noting that modest over-compensation is actually a preferable strategy for Rx, because it compensates for the fading from the Tx side with unknown vendors, but has literally no impact on communication.

On the other hand, the rapid fading occurs at both ends of the spectrum is clearly caused by the Rx end ACR filter. The primary purpose of the ACR filter is to suppress the interference from adjacent channels. However, according to the principles of filter design, better rejection performance contradicts smaller in-band distortion, given that the filter implementation in NIC baseband is fixed and the order is low. As a result, NIC manufacturers often choose to trade the in-band spectrum flatness for better out-of-band rejection, which is reflected in the the rapid fading at the both ends of the spectrum. In term of QCA9300, the ACR filter is a fifth-ordered LPF as previously discussed.

Type 2 distortion may be exactly the Tx DAC fading. According to the scaling property of Fourier Transformation, the change in baseband bandwidth, i.e. baseband sampling rate, will squeeze or stretch the entire spectrum, including the DAC sinc fading response. However, PDP module and ACR filter, essentially reconfigurable filters, are not associated with the baseband clocking, therefore still maintaining their M-shaped response333The technique of overriding QCA9300’s baseband filter and predistortion is still under study.. When baseband is down-clocked, the DAC sinc fading shrinks to narrower spectrum around direct current (DC), while PDP module and ACR filter, remaining untouched, have a very low and relatively flat response around DC. Their mismatched responses around DC create the inverted-V shape response.

Type 3 distortion is essentially the left or right half of Type 1 distortion. In HT40+/- Channel Modes, both the bandwidth and the baseband filters (PDP module and ACR filter) doubles to 40MHz. However, as aforementioned in T1: test for the influence of Rx baseband, the HT40+/- channels communicate with the HT20 channel using only half of their bandwidth. Therefore, the half-utilized spectrum corresponds to the left or right half of Type 1 distortion.

Iv-C CSI model revised for Wi-Fi sensing

According to Tests T1 and T2, the baseband of both Tx and Rx end exert distortion to the CSI, and we use and to denote their influences respectively. Bringing them into Eq. 2, we arrive at the revised CSI model:


Eq. 9 for the first time accommodates the baseband distortion explicitly. However, in practice, Eq. 9 is difficult to apply, because it requires to measure and individually, and its matrix form forbids the merging of and .

Fortunately, we can still rewrite Eq. 9 into a simplified version as follows.


It is because and are both diagonal matrices, which permit the commutative law for Eq. 9 as an exception.

Fig. 13: The asymmetry of CSI distortion. The right part of the dashed lines are the accurate mirrors of the left, showing significant difference form the actual measurements.

Iv-D Why does the distortion only contaminate Wi-Fi sensing, but not for Wi-Fi communication?

For OFDM communication, what matters is not the specific processes or filters the signal goes through, but that all parts of signal experience the exactly same process. Taking the data symbols, for example, i.e. HT-Data symbols in 802.11n, the distortion in data symbols, as well as other channel influence, can be perfectly equalized by the training symbols (HT-LTF) which experience the same distortion. Unfortunately, in Wi-Fi sensing field, the distortion is hurting. Wi-Fi sensing, especially the phase-based sensing, requires precise in-air channel response or purely . However, the baseband distortion bends severely and frequency-selectively, therefore poisons various of accurate sensing applications.

In other words, “Channel” are interpreted differently in contexts of OFDM or Wi-Fi sensing. In the former context, the “channel” refers to the combined effect of ALL kinds of influences, including the baseband distortion. However, in the context of Wi-Fi sensing, the popular interpretation of “channel” refers only to one specific stage of the combined effect, i.e. the in-air signal propagation.

Fig. 14: The left figures show the magnitude and phase distortions measured in strong LoS situation. The figures on the right show both the magnitude and phase measurements before and after the distortion removal. The severely distorted measurements become aligned and smooth after the distortion removal.
Fig. 15: Software architecture of PicoScenes system. PicoScenes consists of 3 layers, namely PicoScenes Drivers, PicoScenes Platform and PicoScenes Plug-in Subsystem. The Drivers provides access to various of hardware features. The Platform abstracts the features into powerful APIs. The Plug-ins perform the core measurement tasks. To support SDR-based Wi-Fi sensing, PicoScenes embeds a software baseband implementation as shown in the right.

Iv-E So, how to get rid of the distortion?

Previous works have proposed methods [34, 46, 27] to eliminate the CSI distortion, however, as they mainly focuses on phase-based sensing, they ignore the magnitude distortion. Xie et al. [34] suggests that the distortion only occurs at both ends of the spectrum and prune the subcarriers at both ends. Zhu et al. [46] and Tadayon et al. [27] both try to curve fit the phase distortion using a central symmetric function, however, as shown in Fig. 13, both magnitude and phase are not symmetric.

We enhance the method from Zhu et al. [46] by storing the raw distortions rather than curve fitting them. As a result, this approach become a general distortion removal method which can cover both magnitude and phase distortion. Quite similar to the previous approach, the users measure explicitly the CSI distortion between all Tx and Rx pairs before the deployment of the sensing application. The measurement can be done by cable-connecting the Tx and Rx or putting them in very strong line-of-sight (LoS) situation. Each Tx/Rx pair measures the CSI and stores the average magnitude and phase distortion. Then in the sensing stage, each CSI measurement should subtract the distortion in magnitude and phase domain, and then reconstruct the complex-valued CSI.

The next problem is, how to verify the correctness of the distortion removal? Zhu et al. [46] stitch the adjacent CSI measurements based on an insight that the CSI measurements from the adjacent yet partially overlapping channels should have identical measurements for the shared part. We adopt the same idea to verify the correctness of the distortion removal. Fig. 14 shows an example of distortion removal. The disjoint raw measurement from adjacent channels become smooth and perfectly aligned with each other after the distortion removal. It is worth noting that we did NOT prune the subcarriers at both ends, and the stitching results are with all subcarriers.

V PicoScenes Platform

We introduce PicoScenes, a powerful, hardware-unified and extensible Wi-Fi sensing platform which is designed to meet the most challenging requirements of the modern Wi-Fi sensing researches. Much beyond the basic CSI data extractor, PicoScenes integrates the packet injection-based Tx and adopts the “drivers + platform + plug-ins” design to support upcoming new CSI-ready hardwares and even software defined radio (SDR). In the following text, we present the architecture of PicoScenes and some design highlights.

V-a PicoScenes Architecture

PicoScenes consists of 3 layers as shown in the left of Fig. 15, namely PicoScenes Drivers, PicoScenes Platform and PicoScenes Plug-in Subsystem, from bottom to top.

PicoScenes Drivers

We create our own version of kernel drivers for the supported COTS NICs. These drivers extract the CSI and expose various of hardware controls to the user space. First of the major enhancements are the unified data format which encapsulates CSI, Rx status descriptor, and even the raw packet content. The second is the multi-NIC support which allows PicoScene Platform to concurrently access the CSI and hardware controls for all Wi-Fi NIC devices. PicoScenes Drivers currently supports two COTS NICs, QCA9300 and IWL5300, and is under active development to support other COTS NICs, such as BCM43xx series[9].

PicoScenes Platform

PicoScenes Platform is essentially a middleware for Wi-Fi sensing. Besides the basic CSI data collection, it integrates the packet injection-based Tx control. It also abstracts the details for all types of frontend devices and exposes unified, powerful and user-friendly APIs to the measurement-specific plug-in layer. The Platform is designed to be extensible that new CSI-extractable hardwares can be easily accommodated by adding descriptive Frontend instances.

Features CSI Measurement/Extraction Tools
PicoScenes Intel 5300 Atheros Nexmon CSI
CSI Tool [10] CSI Tool [34] Extractor [9]
Supported frontend IWL5300, QCA9300, USRP and more IWL5300 QCA9300 BCM43xx
Concurrent multi-NIC CSI extraction
Unified CSI data format
Super high freq. packet injection & CSI measurement for QCA9300 and IWL5300
Arbitrary bandwidth and carrier frequency tuning for QCA9300 and SDR
Turn on/off selected radio chain(s)
Transmit extra sounding HT-LTF for QCA9300 and SDR
Rx EVM for QCA9300 and SDR
Concurrent multi-NIC operation
VHT/HE-rate packet injection for SDR
Tx/Rx with 4x4 MU-MIMO/OFDMA/beamforming for SDR
Carrier freq. and sampling rate tuning for QCA9300 and SDR
Report CSI for 11ax packets for SDR
Cross frontend CSI measurement
Easy installation without kernel build apt install” with auto-update
Support secondary development
Round-trip measurement with channel scan (by EchoProbe plugin)
Support latest kernel versions currently on v5.4 LTS v5.4 LTS
Working on latest host OSes Ubuntu 20.04 LTS 18.04 LTS
TABLE IV: An incomplete list of the feature comparison between PicoScenes and the existing CSI extraction tools

PicoScenes Platform is itself a layered architecture. At the bottom lays the Frontend. For each supported NIC model or even SDR model, we have a Frontend class that encapsulates all supported controls. Thanks to the detailed study for QCA9300 hardware, PicoScenes gives huge advantages for QCA9300 over IWL5300. Besides the aforementioned arbitrary tuning for carrier frequency and bandwidth, PicoScenes also enables other valuable features for QCA9300, such as selecting Tx/Rx radio chain, transmitting extra spatial sounding (ESS) version packets, accessing the hardware registers, etc. Above the Frontend, there is the Abstraction layer which exports the unified APIs to the upper-level plug-ins. To support SDR based Frontend, we embed a high-performance Wi-Fi baseband processing implementation under the Abstract SDR Frontend class, which drives the SDR hardware to work like a full-featured Wi-Fi NIC. We call this mode PicoScenes on SDR, which we will cover later. Above the Abstraction layer, each NIC abstraction has a plug-in manager which discovers and installs the plug-ins in the runtime.

Performance is also one of the core concerns. The whole Platform, written in C++17, embraces the multi-thread design from the very beginning. All performance sensitive tasks run in separate threads, such as the frontend I/O, baseband decoding/encoding for SDR, NIC-level jobs and all plug-in instances. In this way, the measurement jobs specified to multiple NICs can concurrently operator without congestion.

PicoScenes Plug-in Subsystem

realizes the application or measurement-specific tasks. The plug-ins invoke the hardware-independent APIs exposed by Platform to implement various of Wi-Fi sensing or communication tasks in a task-centric manner. We release the PicoScenes Plug-in development kit (PSPDK) which enables users to develop their own measurement plug-ins.

As a demonstration for PSPDK, we develop EchoProbe, a PSPDK-based plug-in which can orchestrate two PicoScenes nodes to perform the round-trip CSI measurement and spectrum scanning through packet injection-based communication. There is two rules defined by EchoProbe, Initiator and Responder. The Initiator injects the self-defined CSIProbeRequest frame, then Responder receives the frame and packages the measured CSI as the reply payload back to the Initiator. In this way, EchoProbe measures the round-trip CSI with 400s. Further it features synchronized jump which tunes and for both nodes at the same time. In this way, EchoProbe achieves the round-trip CSI measurement over a wide spectrum.

PicoScenes CLI

PicoScenes provides a powerful command line interface (CLI). For example, the following commands specify two NICs, #1 on Laptop A and #2 on Laptop B, to perform spectrum scanning of both carrier frequency and bandwidth:

PicoScenes -i 1 –mode responder (run on Laptop A)

PicoScenes -i 2 –mode initiator –cf 2.3e9:5e6:2.4e9 –sf 20e6:5e6:60e6 –repeat 20 –delay 5e3 –mcs 2 –ness 1 –txcm 4 –rxcm 7 (run on Laptop B)

where NIC #1 on Laptop A works in EchoProbe responder mode (-i 1 –mode responder). NIC #2 on Laptop B is the round-trip measurement initiator (–mode initiator). It scans both the carrier frequency from 2300MHz to 2400MHz with 5MHz step (–cf 2.3e9:5e6:2.4e9) and bandwidth or baseband sampling rate from 20MHz to 60MHz with 5MHz step (–sf 20e6:5e6:60e6). For each rate combination, NIC #2 performs 20 round-trip measurements with 5000s interval (–repeat 20 –delay 5e3). Each packet is transmitted with MCS index 2 and ESS feature ON (–mcs 2 –ness 1). At last, the command further specifies the Tx/Rx radio chain that Tx uses the third radio chain and Rx uses all three radio chains (–txcm 4 –rxcm 7).

Table IV lists the major advantages of PicoScenes system over the existing CSI tools.

V-B PicoScenes on SDR

Despite the increasing popularity, the adoption of SDR in Wi-Fi sensing is severely hampered by the lack of the baseband signal processing. As illustrated in the right of Fig 15, we address this issue by embedding a 802.11a/g/n/ac/ax-compatible baseband implementation into the PicoScenes Platform, which transparently empowers SDR devices to work like full-featured Wi-Fi NICs. In this way, the adoption of SDR in Wi-Fi sensing is unprecedentedly simplified. Taking the PicoScenes commands just now, for example, replacing “-i 2” to “-i usrp192.168.10.2” is all need to be done to switch from #2 COTS NICs to the USRP with IP address The substitute USRP-based EchoProbe initiator will perform exactly the same measurement process, except returning much richer and more detailed results. We call this feature PicoScenes on SDR, and it currently supports two hardware models, USRP N210 and X310.

One of the most attractive aspects of PicoScenes on SDR is that, it provides the complete control over the Wi-Fi Tx and Rx, which exhibits overwhelming advantages for Wi-Fi sensing application or research over COTS NICs. On Tx side, we can specify scrambler initial value which is crucial for Wi-Fi based cross-technology communication (CTC), beamforming which enables fine-grained sensing and calibration, extra spatial sounding which enables COTS NIC to measure up to 3 CSI for one single 802.11n frame, etc. On Rx side, besides the basic CSI measurement for HT/VHT/HE-LTF frames, it also return the raw baseband signals, pre-equalized data symbols and even the CSI measurements reconstructed from the decoded HT/VHT/HE-data parts. We believe these unprecedented controls and details can derive more diverse and more accurate sensing applications. In addition, the unified interface for Wi-Fi communication (from 802.11a to 802.11ax Multi-User profile) and large spectrum/bandwidth accessibility simplify the prototyping and development of new Wi-Fi communication or sensing research.

V-C PicoScenes MATLAB Toolbox

PicoScenes adopts the so-called variable and extendable CSI structure, so that the CSI data measured from different NIC models and even SDR share the same entity structure. Further, PicoScenes and Toolbox share one single CSI/baseband data parsing routine, which guarantees the consistency between C++ based and MATLAB-based data parsing and manipulation. Besides the data parsing, Toolbox also ships with many convenient features, such as one-step installation, .csi file drag & drop parsing, a MATLAB App “.csi File Batch Loader”, automatic MATLAB path adding, etc.

V-D Software Release

PicoScenes is released at https://zpj.io/ps. The website has the complete documents, videos tutorials, application notes and even a community forum for PicoScenes system444The website is still under active construction during the review process..

Vi Conclusion

This paper has accomplished three tasks in pursuit of eliminating the barriers of Wi-Fi sensing research. First, an in-depth study on the baseband design of the popular CSI-enabled Wi-Fi NIC QCA9300 has been provided. The results unveiled are of great guiding significance for speculating what happen on other confidential COTS NICs. Second, based on the above knowledge and the unlocked hardware features, we have examined the CSI distortion under various of channel configurations, and experimentally pinpoint the origin of the distortion, i.e. the baseband filters. Last, we have released PicoScenes, a powerful, hardware-unified and extensible Wi-Fi sensing platform. PicoScenes integrates packet injection-based Tx control and CSI extraction, and supports various of hardware settings for QCA9300 and IWL5300. PicoScenes also supports the SDR-based Wi-Fi sensing by embedding a software baseband implementation which allows users to fully control the baseband and obtain much richer measurements.


  • [1] H. Abdelnasser, M. Youssef, and K. A. Harras (2015) WiGest: a ubiquitous wifi-based gesture recognition system. In Proceedings of the 34th IEEE International Conference on Computer Communications (INFOCOM’15), Vol. , pp. 1472–1480. Cited by: §II-A.
  • [2] H. Abdelnasser, K. A. Harras, and M. Youssef (2015) UbiBreathe: a ubiquitous non-invasive wifi-based breathing estimator. In Proceedings of the 16th ACM International Symposium on Mobile Ad Hoc Networking and Computing (MobiHoc’15), pp. 277–286. Cited by: §I.
  • [3] S. Abdollahi-Alibeik, D. Weber, H. Dogan, and et al. (2011) A 65nm dual-band 3-stream 802.11n mimo wlan soc. In Proceedings of 2011 IEEE International Solid-State Circuits Conference (ISSCC’11), Vol. , pp. 170–172. Cited by: §III-A.
  • [4] R. Ayyalasomayajula, D. Vasisht, and D. Bharadia (2018) BLoc: csi-based accurate localization for ble tags. In Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies (CoNEXT’18), pp. 126–138. Cited by: §I, §II-B.
  • [5] Y. Bai, Z. Wang, K. Zheng, X. Wang, and J. Wang (2019) WiDrive: adaptive wifi-based recognition of driver activity for real-time and safe takeover. In Proceedings of the 39th IEEE International Conference on Distributed Computing Systems (ICDCS’19), Vol. , pp. 901–911. Cited by: §I.
  • [6] Z. Chen, P. Yang, J. Xiong, Y. Feng, and X. -Y. Li (2020) TagRay: contactless sensing and tracking of mobile objects using cots rfid devices. In Proceedings of the 39th IEEE International Conference on Computer Communications (INFOCOM’20), Vol. , pp. 307–316. Cited by: §II-A.
  • [7] T. D. Chiueh, P. Y. Tsai, and L. I-Wei (2012) Baseband Receiver Design for Wireless MIMO-OFDM Communications. Cited by: §IV-A3.
  • [8] C. Feng, J. Xiong, L. Chang, J. Wang, X. Chen, D. Fang, and Z. Tang (2019) WiMi: target material identification with commodity wi-fi devices. In Proceedings of the 39th IEEE International Conference on Distributed Computing Systems (ICDCS’19), Vol. , pp. 700–710. Cited by: §II-A.
  • [9] F. Gringoli, M. Schulz, J. Link, and M. Hollick (2019) Free your csi: a channel state information extraction platform for modern wi-fi chipsets. In Proceedings of the 13th International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH’19), pp. 21–28. Cited by: §I, §I, §II-B, §V-A, TABLE IV.
  • [10] D. Halperin, W. Hu, A. Sheth, and D. Wetherall (2011) Tool release: gathering 802.11n traces with channel state information. ACM SIGCOMM CCR 41 (1), pp. 53. Cited by: §I, TABLE IV.
  • [11] A. Hanif, M. Iqbal, and F. Munir (2018) WiSpy: through-wall movement sensing and person counting using commodity wifi signals. In IEEE SENSORS, Vol. , pp. 1–4. Cited by: §I.
  • [12] F. Hong, X. Wang, Y. Yang, Y. Zong, Y. Zhang, and Z. Guo (2016) WFID: passive device-free human identification using wifi signal. In Proceedings of the 13th International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services (MOBIQUITOUS’16), pp. 47–56. Cited by: §I.
  • [13] Cited by: §III-A, §III-B2.
  • [14] IEEE LAN/MAN Standard Committee (2009-10) IEEE 802.11 Amendment 5 (802.11n): Enhancements for Higher Throughput in Wireless LANs. IEEE Wireless Communications. Cited by: §III-B2.
  • [15] N. Keerativoranan, P. Hanpinitsak, K. Saito, and J. -I. Takada (2020) Analysis of non-intrusive hand trajectory tracking by utilizing micro-doppler signature obtained from wi-fi channel state information. IEEE Access 8 (), pp. 176430–176444. Cited by: §II-A.
  • [16] D. A. Khan, S. Razak, B. Raj, and R. Singh (2019) Human behaviour recognition using wifi channel state information. In Proceedings of 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP’19), pp. 7625–7629. Cited by: §II-A.
  • [17] M. Kotaru and S. Katti (2017) Position tracking for virtual reality using commodity wifi. In

    Proceedings of IEEE International Conference on Computer Vision and Pattern Recognition (CVPR’17)

    Vol. , pp. 2671–2681. Cited by: §II-A, §II-B.
  • [18] M. Kotaru, K. R. Joshi, D. Bharadia, and S. Katti (2015) SpotFi: decimeter level localization using wifi. In Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication (SIGCOMM’15), pp. 269–282. Cited by: §II-A, §II-B.
  • [19] H. Li, W. Yang, J. Wang, Y. Xu, and L. Huang (2016) WiFinger: talk to your smart devices with finger-grained gesture. In Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp’16), pp. 250–261. Cited by: §I, §II-A.
  • [20] Linux Wireless Wikipedia Atheros Linux wireless drivers – ath9k. Note: https://wireless.wiki.kernel.org/en/users/Drivers/ath9k Cited by: §III-A.
  • [21] Y. Ma, G. Zhou, S. Wang, H. Zhao, and W. Jung (2018) SignFi: sign language recognition using wifi. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 2 (1), pp. 1–21. Cited by: §I.
  • [22] Y. Ma, G. Zhou, and S. Wang (2019-06) WiFi sensing with channel state information: a survey. ACM Comput. Surv. 52 (3), pp. 1–36. External Links: ISSN 0360-0300 Cited by: §II-A.
  • [23] K. Qian, C. Wu, Y. Zhang, G. Zhang, Z. Yang, and Y. Liu (2018) Widar2.0: passive human tracking with a single wi-fi link. In Proceedings of the 16th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys’18), pp. 350–361. Cited by: §I.
  • [24] S. G. Sankaran, B. J. Zargari, and e. al. L. Y. Nathawad (2009) Design and Implementation of A CMOS 802.11n SoC. IEEE Communications Magazine 47 (4), pp. 134–143. Cited by: §III-A, §III-B2.
  • [25] S. Shi, Y. Xie, M. Li, A. X. Liu, and J. Zhao (2019) Synthesizing wider wifi bandwidth for respiration rate monitoring in dynamic environments. In Proceedings of the 38th IEEE International Conference on Computer Communications (INFOCOM’19), Vol. , pp. 181–189. Cited by: §II-A.
  • [26] B. Sklar (2006) Digital communication: fundamentals and applications. Publishing House of Electronics Industry. Cited by: §III-B2, §III-B2.
  • [27] N. Tadayon, M. T. Rahman, S. Han, S. Valaee, and W. Yu (2019) Decimeter ranging with channel state information. IEEE Transactions on Wireless Communications 18 (7), pp. 3453–3468. Cited by: §I, §IV-E.
  • [28] H. Wang, D. Zhang, Y. Wang, J. Ma, Y. Wang, and S. Li (2017) RT-fall: a real-time and contactless fall detection system with commodity wifi devices. IEEE Transactions on Mobile Computing 16 (2), pp. 511–526. Cited by: §II-A.
  • [29] L. Wang, K. Sun, H. Dai, A. X. Liu, and X. Wang (2018) WiTrace: centimeter-level passive gesture tracking using wifi signals. In Proceedings of the 15th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON’18), Vol. , pp. 1–9. Cited by: §I.
  • [30] W. Wang, A. X. Liu, M. Shahzad, K. Ling, and S. Lu (2015) Understanding and modeling of wifi signal based human activity recognition. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (MobiCom’15), pp. 65–76. Cited by: §II-A.
  • [31] C. Wu, F. Zhang, Y. Fan, and K. J. R. Liu (2019) RF-based inertial measurement. In Proceedings of the ACM Special Interest Group on Data Communication (SIGCOMM’19), pp. 117–129. Cited by: §II-A, §II-B.
  • [32] D. Wu, D. Zhang, C. Xu, H. Wang, and X. Li (2017) Device-free wifi human sensing: from pattern-based to model-based approaches. IEEE Communications Magazine 55 (10), pp. 91–97. Cited by: §II-A.
  • [33] J. Xiao, H. Li, and Y. Liu (2019) WiWrite: wi-fi based handwriting recognition like playing lego. In Proceedings of the 28th International Conference on Computer Communication and Networks (ICCCN’19), pp. 1–9. Cited by: §II-A.
  • [34] Y. Xie, Z. Li, and M. Li (2019) Precise Power Delay Profiling with Commodity Wi-Fi. IEEE Transactions on Mobile Computing 18 (6), pp. 1342–1355. Cited by: §I, §I, §II-B, §III-B1, §IV-E, TABLE IV.
  • [35] Y. Xie, J. Xiong, M. Li, and K. Jamieson (2019) MD-track: leveraging multi-dimensionality for passive indoor wi-fi tracking. In Proceedings of the 25th Annual International Conference on Mobile Computing and Networking (MobiCom’19), pp. 1–16. Cited by: §II-A.
  • [36] Y. Xie, Y. Zhang, J. C. Liando, and M. Li (2018) SWAN: stitched wi-fi antennas. In Proceedings of the 24th Annual International Conference on Mobile Computing and Networking (MobiCom’18), pp. 51–66. Cited by: §II-B.
  • [37] J. Xiong, K. Sundaresan, and K. Jamieson (2015) ToneTrack: leveraging frequency-agile radios for time-based indoor wireless localization. In Proceedings of the 21st Annual International Conference on Mobile Computing and Networking (MobiCom’15), pp. 537–549. Cited by: §I, §II-B.
  • [38] Z. Yang, C. Wu, and Y. Liu (2012) Locating in fingerprint space: wireless indoor localization with little human intervention. In Proceedings of the 18th Annual International Conference on Mobile Computing and Networking (MobiCom’12), pp. 269–280. Cited by: §II-A.
  • [39] M. Zargari, L. Y. Nathawad, H. Samavati, and et al. (2008) A Dual-Band CMOS MIMO Radio SoC for IEEE 802.11n Wireless LAN. IEEE Journal of Solid-State Circuits 43 (12), pp. 2882–2895. Cited by: §III-A.
  • [40] Y. Zeng, D. Wu, J. Xiong, J. Liu, Z. Liu, and D. Zhang (2020) MultiSense: enabling multi-person respiration sensing with commodity wifi. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 4 (3), pp. 102. Cited by: §II-A.
  • [41] D. Zhang, Y. Hu, Y. Chen, and B. Zeng (2019) BreathTrack: tracking indoor human breath status via commodity wifi. IEEE Internet of Things Journal 6 (2), pp. 3899–3911. Cited by: §I.
  • [42] M. Zhao, T. Li, M. A. Alsheikh, Y. Tian, and D. Katabi (2018) Through-wall human pose estimation using radio signals. In Computer Vision and Pattern Recognition (CVPR’18), Cited by: §II-A.
  • [43] M. Zhao, Y. Tian, H. Zhao, M. A. Alsheikh, T. Li, R. Hristov, Z. Kabelac, D. Katabi, and A. Torralba (2018) RF-based 3d skeletons. In Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication (SIGCOMM’18), pp. 267–281. Cited by: §II-A.
  • [44] S. Zhao, Z. Qu, Z. Luo, Z. Lu, and Y. Liu (2020-02) Comb decoding towards collision-free wifi. In Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI’20), pp. 933–951. External Links: ISBN 978-1-939133-13-7 Cited by: §I, §II-B.
  • [45] Y. Zheng, G. Shen, L. Li, C. Zhao, M. Li, and F. Zhao (2014) Travi-navi: self-deployable indoor navigation system. In Proceedings of the 20th Annual International Conference on Mobile Computing and Networking (MobiCom’14), pp. 471–482. Cited by: §II-A.
  • [46] H. Zhu, Y. Zhuo, Q. Liu, and S. Chang (2018) Splicer: perceiving accurate csi phases with commodity wifi devices. IEEE Transactions on Mobile Computing 17 (9), pp. 2155–2165. Cited by: §I, §IV-E, §IV-E, §IV-E.
  • [47] Y. Zhu, Z. Xiao, Y. Chen, Z. Li, M. Liu, B. Y. Zhao, and H. Zheng (2020) Et tu alexa? when commodity wifi devices turn into adversarial motion sensors. In Proceedings of the Network and Distributed System Security Symposium (NDSS’20), Cited by: §II-B.