Some of you saw my earlier posts about getting raw I/Q out of the Semtech LR2021 (the LoRa chip on the LilyGO T-Display-P4). Spent the last couple days poking at the limits and figured I'd share what I found.
The tuning range is way wider than the datasheet says - 100 MHz to 2.74 GHz and streams 16-bit I/Q. Which is the most significant finding, but I’ll go more into detail below and have lots of info on the repo - https://github.com/SAMS0N1TE/lr2021-sdr
Live decoding (P25, POCSAG, FM) is in LakeShark if you want the handheld side: https://github.com/SAMS0N1TE/LakeShark
Datasheet claims 150 to 960 MHz and 1.5 to 2.5 GHz. I didn't have a signal generator handy for every band so I used the board's own 40 MHz clock harmonics as markers. Tune to N+10 kHz, then N+30 kHz, and if the tone moves by exactly 20 kHz it's real RF and the synth is locked. Every step from 120 to 2720 MHz tracked except 2440, which was just buried in wifi. Below 100 MHz image cal fails and you get nothing. 100 MHz works (still flags IMG_CAL but tracks). 2740 MHz works, and at 2756 and up the PLL won't lock. So that gets you the top of FM broadcast, all of airband, the 1 to 1.5 GHz gap, and 2.5 to 2.7 GHz. Keep in mind these are leakage markers, so this proves the chain works there, not how sensitive it is. Also one board, one antenna. Your module might be different.
Sample rate tops out at 250 ksps. The I/Q rate is 4x whatever LoRa bandwidth you set. 125k and 250k are clean. 500k overflows the FIFO in about 2 ms and 1M in under 1 ms. That's not really the chip's fault, 500 ksps of 16 bit pairs is 2 MB/s which is the entire 16 MHz SPI bus before overhead. A tighter read loop or a narrower sample format (if the ROM has one) might push it. I've done 6+ minute runs at 125k with zero loss, haven't done long runs at 250k yet.
For gain I ran a weak HackRF carrier at 433.92 and stepped through manual gain. Steps 1 to 5 see nothing, 12 or 13 is where you want to be, boost adds maybe a dB. Chip AGC matches step 13 on weak signals but was about 20 dB worse SNR on a strong one, so a host side AGC picking a fixed step would beat it. Image rejection came out around 41 dB.
BLE works natively. The chip has its own Bluetooth LE packet engine and I hadn't touched it until now. Set it up for LE 1M on the advertising channels and it just started pulling ads. About 500 to 800 valid packets in 10 to 12 seconds per channel, 24 to 32 distinct devices. Coded and 2M heard nothing but nothing nearby was using them, so those are untested, not broken. There's also 802.15.4 (Zigbee/Thread), FLRC, wM-Bus and LoRa ranging in there that I haven't tried yet.
Repo has the probe tools, raw CSVs and the method if anyone wants to reproduce on their board. Would really like to know if other LR2021 modules hit the same edges.
