* so use free_node here instead of unref_node.
* so use release_node here instead of unref_node.
atw_rxintr(struct atw_softc *sc){	static int rate_tbl[] = {2, 4, 11, 22, 44};	struct ieee80211com *ic = &sc->sc_ic;	struct ieee80211_node *ni;	struct ieee80211_frame *wh;	struct ifnet *ifp = &ic->ic_if;	struct atw_rxsoft *rxs;	struct mbuf *m;	u_int32_t rxstat;	int i, len, rate, rate0;	u_int32_t rssi, rssi0;	for (i = sc->sc_rxptr;; i = ATW_NEXTRX(i)) {		rxs = &sc->sc_rxsoft[i];		ATW_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);		rxstat = letoh32(sc->sc_rxdescs[i].ar_stat);		rssi0 = letoh32(sc->sc_rxdescs[i].ar_rssi);		rate0 = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_RXDR_MASK);		if (rxstat & ATW_RXSTAT_OWN)			break; /* We have processed all receive buffers. */		DPRINTF3(sc,		    ("%s: rx stat %08x rssi0 %08x buf1 %08x buf2 %08x\n",		    sc->sc_dev.dv_xname,		    rxstat, rssi0,		    letoh32(sc->sc_rxdescs[i].ar_buf1),		    letoh32(sc->sc_rxdescs[i].ar_buf2)));		/*		 * Make sure the packet fits in one buffer.  This should		 * always be the case.		 */		if ((rxstat & (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) !=		    (ATW_RXSTAT_FS|ATW_RXSTAT_LS)) {			printf("%s: incoming packet spilled, resetting\n",			    sc->sc_dev.dv_xname);			(void)atw_init(ifp);			return;		}		/*		 * If an error occurred, update stats, clear the status		 * word, and leave the packet buffer in place.  It will		 * simply be reused the next time the ring comes around.	 	 * If 802.1Q VLAN MTU is enabled, ignore the Frame Too Long		 * error.		 */		if ((rxstat & ATW_RXSTAT_ES) != 0 &&#if defined(__OpenBSD__)		    ((sc->sc_ic.ic_if.if_capabilities & IFCAP_VLAN_MTU) == 0 ||#else		    ((sc->sc_ic.ic_ec.ec_capenable & ETHERCAP_VLAN_MTU) == 0 ||#endif		     (rxstat & (ATW_RXSTAT_DE | ATW_RXSTAT_SFDE |		                ATW_RXSTAT_SIGE | ATW_RXSTAT_CRC16E |				ATW_RXSTAT_RXTOE | ATW_RXSTAT_CRC32E |				ATW_RXSTAT_ICVE)) != 0)) {#define	PRINTERR(bit, str)						\			if (rxstat & (bit))				\				printf("%s: receive error: %s\n",	\				    sc->sc_dev.dv_xname, str)			ifp->if_ierrors++;			PRINTERR(ATW_RXSTAT_DE, "descriptor error");			PRINTERR(ATW_RXSTAT_SFDE, "PLCP SFD error");			PRINTERR(ATW_RXSTAT_SIGE, "PLCP signal error");			PRINTERR(ATW_RXSTAT_CRC16E, "PLCP CRC16 error");			PRINTERR(ATW_RXSTAT_RXTOE, "time-out");			PRINTERR(ATW_RXSTAT_CRC32E, "FCS error");			PRINTERR(ATW_RXSTAT_ICVE, "WEP ICV error");#undef PRINTERR			ATW_INIT_RXDESC(sc, i);			continue;		}		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);		/*		 * No errors; receive the packet.  Note the ADM8211		 * includes the CRC in promiscuous mode.		 */		len = MASK_AND_RSHIFT(rxstat, ATW_RXSTAT_FL_MASK);		/*		 * Allocate a new mbuf cluster.  If that fails, we are		 * out of memory, and must drop the packet and recycle		 * the buffer that's already attached to this descriptor.		 */		m = rxs->rxs_mbuf;		if (atw_add_rxbuf(sc, i) != 0) {			ifp->if_ierrors++;			ATW_INIT_RXDESC(sc, i);			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,			    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);			continue;		}		ifp->if_ipackets++;		if (sc->sc_opmode & ATW_NAR_PR)			m->m_flags |= M_HASFCS;		m->m_pkthdr.rcvif = ifp;		m->m_pkthdr.len = m->m_len = MIN(m->m_ext.ext_size, len);		if (rate0 >= sizeof(rate_tbl) / sizeof(rate_tbl[0]))			rate = 0;		else			rate = rate_tbl[rate0];		/* The RSSI comes straight from a register in the		 * baseband processor.  I know that for the RF3000,		 * the RSSI register also contains the antenna-selection		 * bits.  Mask those off.		 *		 * TBD Treat other basebands.		 */		if (sc->sc_bbptype == ATW_BBPTYPE_RFMD)			rssi = rssi0 & RF3000_RSSI_MASK;		else			rssi = rssi0;#if NBPFILTER > 0		/* Pass this up to any BPF listeners. */		if (sc->sc_radiobpf != NULL) {			struct mbuf mb;			struct atw_rx_radiotap_header *tap = &sc->sc_rxtap;			tap->ar_rate = rate;			tap->ar_chan_freq = ic->ic_bss->ni_chan->ic_freq;			tap->ar_chan_flags = ic->ic_bss->ni_chan->ic_flags;			/* TBD verify units are dB */			tap->ar_antsignal = (int)rssi;			/* TBD tap->ar_flags */			M_DUP_PKTHDR(&mb, m);			mb.m_data = (caddr_t)tap;			mb.m_len = tap->ar_ihdr.it_len;			mb.m_next = m;			mb.m_pkthdr.len += mb.m_len;			bpf_mtap(sc->sc_radiobpf, &mb); 		}#endif /* NPBFILTER > 0 */		wh = mtod(m, struct ieee80211_frame *);		ni = ieee80211_find_rxnode(ic, wh);		if (atw_hw_decrypted(sc, wh))			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;		ieee80211_input(ifp, m, ni, (int)rssi, 0);		/*		 * The frame may have caused the node to be marked for		 * reclamation (e.g. in response to a DEAUTH message)		 * so use free_node here instead of unref_node.		 */		if (ni == ic->ic_bss)			ieee80211_unref_node(&ni);		else			ieee80211_free_node(ic, ni);	}	/* Update the receive pointer. */	sc->sc_rxptr = i;}