I am working on another AR9170 project. This essentially requires injecting broadcast packets of specific size, frequency, ... at extremely precise intervals. I am trying to understand the data flow in the firmware. Initially I was looking to generate the frames in the firmware. The payload is simple. Though I am pondering the wisdom of that right now. Regardless, I will have to control my frames in firmware, so I need to separate them from normal traffic and then feed them into the Radio Queues at the appropriate times. Am I correct that the same struct dma_desc is being used by both USB and the Radio ? Each dma_desc points to a payload, for tx packets this is a struct carl9170_tx_superframe, which must also be what the skb pointed to by void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb) is sending ? Can I construct a carl9170_tx_superframe on the host side, with something to allow me to identify it in handle_download in the firmware, perform minor mangling of the contents, and repeatedly transmit it at fixed intervals using wlan_tx() ? -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html