A Dummy Transmission is a transmission that doesn't actually get sent.

Packet Composition

The packet that is sent depends on the PHY type. The first 6 bytes are for the PLCP data (see PLCP header), the remainder is an ACK packet (type 0b01, subtype 0b1101)

For A PHYs

CC 01 02 00 00 00 D4 00 00 00 00 00 00 00 00 01 00 00 00 00

For B/G PHYs

6E 84 0B 00 00 00 D4 00 00 00 00 00 00 00 00 01 00 00 00 00

These values are in big endian order (i.e. as they ought to be transmitted or written to the template ram if that is in big endian mode).

Note that we suspect a bug in the driver because the last 4 bytes of this overwrite the PLCP header of the next packet in the TemplateRam. Also, the trailing zeroes would form the FCS of the 802.11 packet which don't seem to be present in other packets in the TemplateRam, and are not correct either. That no one notices this bug problably means that the next packet isn't ever used. But we don't know.

As you can easily see, these packets differ only in the PLCP part, the actual packet is the same (an ACK packet).

Performing the Dummy Transmission

1. Write the packet you wish to send to TemplateRam, offset 0

2. Perform a Dummy Read on MMIO offset 0x120

3. Write 0 to MMIO offset 0x568

4. Write 0 to MMIO offset 0x7C0

5. Write to MMIO offset 0x50C the PHY type: 1 for A, 0 for B/G

6. Write 0 to MMIO offset 0x508

7. Write 0 to MMIO offset 0x50A

8. Write 0 to MMIO offset 0x54C

9. Write 0x14 to MMIO offset 0x56A

10. Write 0x826 to MMIO offset 0x568

11. Write 0 to MMIO offset 0x500

12. Write 0x30 to MMIO offset 0x502

13. If the Radio Version is 0x2050 and the Radio Revision is 0x5 or less

    1. Write 0x17 to RadioRegister 0x51

14. Spinwait until MMIO offset 0x50E has bit 0x80 set, at most 300 usecs for A PHYs, 2500 usecs for B/G PHYs, with a delay of 10 usecs

15. Spinwait until MMIO offset 0x50E has bit 0x400 set, at most 100 usecs, with a delay of 10 usecs

16. Spinwait until MMIO offset 0x690 has bit 0x100 unset, at most 100 usecs, with a delay of 10 usecs

17. If the Radio Version is 0x2050 and the Radio Revision is 0x5 or less

    1. Write 0x37 to RadioRegister 0x51