if (ni != NULL && ni != ic->ic_bss) ieee80211_free_node(ic, ni);
if (ni != NULL) ieee80211_release_node(ic, ni);
atw_start(struct ifnet *ifp){	struct atw_softc *sc = ifp->if_softc;	struct ieee80211com *ic = &sc->sc_ic;	struct ieee80211_node *ni;	struct ieee80211_frame *wh;	struct atw_frame *hh;	struct mbuf *m0, *m;	struct atw_txsoft *txs, *last_txs;	struct atw_txdesc *txd;	int do_encrypt, rate;	bus_dmamap_t dmamap;	int ctl, error, firsttx, nexttx, lasttx = -1, first, ofree, seg;	DPRINTF2(sc, ("%s: atw_start: sc_flags 0x%08x, if_flags 0x%08x\n",	    sc->sc_dev.dv_xname, sc->sc_flags, ifp->if_flags));	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)		return;	/*	 * Remember the previous number of free descriptors and	 * the first descriptor we'll use.	 */	ofree = sc->sc_txfree;	firsttx = sc->sc_txnext;	DPRINTF2(sc, ("%s: atw_start: txfree %d, txnext %d\n",	    sc->sc_dev.dv_xname, ofree, firsttx));	/*	 * Loop through the send queue, setting up transmit descriptors	 * until we drain the queue, or use up all available transmit	 * descriptors.	 */	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&	       sc->sc_txfree != 0) {		/*		 * Grab a packet off the management queue, if it		 * is not empty. Otherwise, from the data queue.		 */		IF_DEQUEUE(&ic->ic_mgtq, m0);		if (m0 != NULL) {			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;			m0->m_pkthdr.rcvif = NULL;		} else {			/* send no data packets until we are associated */			if (ic->ic_state != IEEE80211_S_RUN)				break;			IFQ_DEQUEUE(&ifp->if_snd, m0);			if (m0 == NULL)				break;#if NBPFILTER > 0			if (ifp->if_bpf != NULL)				bpf_mtap(ifp->if_bpf, m0);#endif /* NBPFILTER > 0 */			if ((m0 = ieee80211_encap(ifp, m0, &ni)) == NULL) {				ifp->if_oerrors++;				break;			}		}		rate = MAX(ieee80211_get_rate(ic), 2);#if NBPFILTER > 0		/*		 * Pass the packet to any BPF listeners.		 */		if (ic->ic_rawbpf != NULL)			bpf_mtap(ic->ic_rawbpf, m0);		if (sc->sc_radiobpf != NULL) {			struct mbuf mb;			struct atw_tx_radiotap_header *tap = &sc->sc_txtap;			tap->at_rate = rate;			tap->at_chan_freq = ic->ic_bss->ni_chan->ic_freq;			tap->at_chan_flags = ic->ic_bss->ni_chan->ic_flags;			/* TBD tap->at_flags */			M_DUP_PKTHDR(&mb, m0);			mb.m_data = (caddr_t)tap;			mb.m_len = tap->at_ihdr.it_len;			mb.m_next = m0;			mb.m_pkthdr.len += mb.m_len;			bpf_mtap(sc->sc_radiobpf, &mb);		}#endif /* NBPFILTER > 0 */		M_PREPEND(m0, offsetof(struct atw_frame, atw_ihdr), M_DONTWAIT);		if (ni != NULL && ni != ic->ic_bss)			ieee80211_free_node(ic, ni);		if (m0 == NULL) {			ifp->if_oerrors++;			break;		}		/* just to make sure. */		m0 = m_pullup(m0, sizeof(struct atw_frame));		if (m0 == NULL) {			ifp->if_oerrors++;			break;		}		hh = mtod(m0, struct atw_frame *);		wh = &hh->atw_ihdr;		do_encrypt = ((wh->i_fc[1] & IEEE80211_FC1_WEP) != 0) ? 1 : 0;		/* Copy everything we need from the 802.11 header:		 * Frame Control; address 1, address 3, or addresses		 * 3 and 4. NIC fills in BSSID, SA.		 */		if (wh->i_fc[1] & IEEE80211_FC1_DIR_TODS) {			if (wh->i_fc[1] & IEEE80211_FC1_DIR_FROMDS)				panic("%s: illegal WDS frame",				    sc->sc_dev.dv_xname);			memcpy(hh->atw_dst, wh->i_addr3, IEEE80211_ADDR_LEN);		} else			memcpy(hh->atw_dst, wh->i_addr1, IEEE80211_ADDR_LEN);		*(u_int16_t*)hh->atw_fc = *(u_int16_t*)wh->i_fc;		/* initialize remaining Tx parameters */		memset(&hh->u, 0, sizeof(hh->u));		hh->atw_rate = rate * 5;		/* XXX this could be incorrect if M_FCS. _encap should		 * probably strip FCS just in case it sticks around in		 * bridged packets.		 */		hh->atw_service = IEEE80211_PLCP_SERVICE; /* XXX guess */		hh->atw_paylen = htole16(m0->m_pkthdr.len -		    sizeof(struct atw_frame));		hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);		hh->atw_rtylmt = 3;		hh->atw_hdrctl = htole16(ATW_HDRCTL_UNKNOWN1);		if (do_encrypt) {			hh->atw_hdrctl |= htole16(ATW_HDRCTL_WEP);			hh->atw_keyid = ic->ic_wep_txkey;		}		/* TBD 4-addr frames */		atw_frame_setdurs(sc, hh, rate,		    m0->m_pkthdr.len - sizeof(struct atw_frame) +		    sizeof(struct ieee80211_frame) + IEEE80211_CRC_LEN);		/* never fragment multicast frames */		if (IEEE80211_IS_MULTICAST(hh->atw_dst)) {			hh->atw_fragthr = htole16(ATW_FRAGTHR_FRAGTHR_MASK);		} else if (sc->sc_flags & ATWF_RTSCTS) {			hh->atw_hdrctl |= htole16(ATW_HDRCTL_RTSCTS);		}#ifdef ATW_DEBUG		hh->atw_fragnum = 0;		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {			printf("%s: dst = %s, rate = 0x%02x, "			    "service = 0x%02x, paylen = 0x%04x\n",			    sc->sc_dev.dv_xname, ether_sprintf(hh->atw_dst),			    hh->atw_rate, hh->atw_service, hh->atw_paylen);			printf("%s: fc[0] = 0x%02x, fc[1] = 0x%02x, "			    "dur1 = 0x%04x, dur2 = 0x%04x, "			    "dur3 = 0x%04x, rts_dur = 0x%04x\n",			    sc->sc_dev.dv_xname, hh->atw_fc[0], hh->atw_fc[1],			    hh->atw_tail_plcplen, hh->atw_head_plcplen,			    hh->atw_tail_dur, hh->atw_head_dur);			printf("%s: hdrctl = 0x%04x, fragthr = 0x%04x, "			    "fragnum = 0x%02x, rtylmt = 0x%04x\n",			    sc->sc_dev.dv_xname, hh->atw_hdrctl,			    hh->atw_fragthr, hh->atw_fragnum, hh->atw_rtylmt);			printf("%s: keyid = %d\n",			    sc->sc_dev.dv_xname, hh->atw_keyid);			atw_dump_pkt(ifp, m0);		}#endif /* ATW_DEBUG */		dmamap = txs->txs_dmamap;		/*		 * Load the DMA map.  Copy and try (once) again if the packet		 * didn't fit in the alloted number of segments.		 */		for (first = 1;		     (error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,		                  BUS_DMA_WRITE|BUS_DMA_NOWAIT)) != 0 && first;		     first = 0) {			MGETHDR(m, M_DONTWAIT, MT_DATA);			if (m == NULL) {				printf("%s: unable to allocate Tx mbuf\n",				    sc->sc_dev.dv_xname);				break;			}			if (m0->m_pkthdr.len > MHLEN) {				MCLGET(m, M_DONTWAIT);				if ((m->m_flags & M_EXT) == 0) {					printf("%s: unable to allocate Tx "					    "cluster\n", sc->sc_dev.dv_xname);					m_freem(m);					break;				}			}			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;			m_freem(m0);			m0 = m;			m = NULL;		}		if (error != 0) {			printf("%s: unable to load Tx buffer, "			    "error = %d\n", sc->sc_dev.dv_xname, error);			m_freem(m0);			break;		}		/*		 * Ensure we have enough descriptors free to describe		 * the packet.		 */		if (dmamap->dm_nsegs > sc->sc_txfree) {			/*			 * Not enough free descriptors to transmit			 * this packet.  Unload the DMA map and			 * drop the packet.  Notify the upper layer			 * that there are no more slots left.			 *			 * XXX We could allocate an mbuf and copy, but			 * XXX it is worth it?			 */			ifp->if_flags |= IFF_OACTIVE;			bus_dmamap_unload(sc->sc_dmat, dmamap);			m_freem(m0);			break;		}		/*		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.		 */		/* Sync the DMA map. */		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,		    BUS_DMASYNC_PREWRITE);		/* XXX arbitrary retry limit; 8 because I have seen it in		 * use already and maybe 0 means "no tries" !		 */		ctl = htole32(LSHIFT(8, ATW_TXCTL_TL_MASK));		DPRINTF2(sc, ("%s: TXDR <- max(10, %d)\n",		    sc->sc_dev.dv_xname, rate * 5));		ctl |= htole32(LSHIFT(MAX(10, rate * 5), ATW_TXCTL_TXDR_MASK));		/*		 * Initialize the transmit descriptors.		 */		for (nexttx = sc->sc_txnext, seg = 0;		     seg < dmamap->dm_nsegs;		     seg++, nexttx = ATW_NEXTTX(nexttx)) {			/*			 * If this is the first descriptor we're			 * enqueueing, don't set the OWN bit just			 * yet.  That could cause a race condition.			 * We'll do it below.			 */			txd = &sc->sc_txdescs[nexttx];			txd->at_ctl = ctl |			    ((nexttx == firsttx) ? 0 : htole32(ATW_TXCTL_OWN));			txd->at_buf1 = htole32(dmamap->dm_segs[seg].ds_addr);			txd->at_flags =			    htole32(LSHIFT(dmamap->dm_segs[seg].ds_len,			                   ATW_TXFLAG_TBS1_MASK)) |			    ((nexttx == (ATW_NTXDESC - 1))			        ? htole32(ATW_TXFLAG_TER) : 0);			lasttx = nexttx;		}		IASSERT(lasttx != -1, ("bad lastx"));		/* Set `first segment' and `last segment' appropriately. */		sc->sc_txdescs[sc->sc_txnext].at_flags |=		    htole32(ATW_TXFLAG_FS);		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_LS);#ifdef ATW_DEBUG		if ((ifp->if_flags & IFF_DEBUG) != 0 && atw_debug > 2) {			printf("     txsoft %p transmit chain:\n", txs);			for (seg = sc->sc_txnext;; seg = ATW_NEXTTX(seg)) {				printf("     descriptor %d:\n", seg);				printf("       at_ctl:   0x%08x\n",				    letoh32(sc->sc_txdescs[seg].at_ctl));				printf("       at_flags:      0x%08x\n",				    letoh32(sc->sc_txdescs[seg].at_flags));				printf("       at_buf1: 0x%08x\n",				    letoh32(sc->sc_txdescs[seg].at_buf1));				printf("       at_buf2: 0x%08x\n",				    letoh32(sc->sc_txdescs[seg].at_buf2));				if (seg == lasttx)					break;			}		}#endif		/* Sync the descriptors we're using. */		ATW_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);		/*		 * Store a pointer to the packet so we can free it later,		 * and remember what txdirty will be once the packet is		 * done.		 */		txs->txs_mbuf = m0;		txs->txs_firstdesc = sc->sc_txnext;		txs->txs_lastdesc = lasttx;		txs->txs_ndescs = dmamap->dm_nsegs;		/* Advance the tx pointer. */		sc->sc_txfree -= dmamap->dm_nsegs;		sc->sc_txnext = nexttx;		SIMPLEQ_REMOVE_HEAD(&sc->sc_txfreeq, txs_q);		SIMPLEQ_INSERT_TAIL(&sc->sc_txdirtyq, txs, txs_q);		last_txs = txs;	}	if (txs == NULL || sc->sc_txfree == 0) {		/* No more slots left; notify upper layer. */		ifp->if_flags |= IFF_OACTIVE;	}	if (sc->sc_txfree != ofree) {		DPRINTF2(sc, ("%s: packets enqueued, IC on %d, OWN on %d\n",		    sc->sc_dev.dv_xname, lasttx, firsttx));		/*		 * Cause a transmit interrupt to happen on the		 * last packet we enqueued.		 */		sc->sc_txdescs[lasttx].at_flags |= htole32(ATW_TXFLAG_IC);		ATW_CDTXSYNC(sc, lasttx, 1,		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);		/*		 * The entire packet chain is set up.  Give the		 * first descriptor to the chip now.		 */		sc->sc_txdescs[firsttx].at_ctl |= htole32(ATW_TXCTL_OWN);		ATW_CDTXSYNC(sc, firsttx, 1,		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);		/* Wake up the transmitter. */		ATW_WRITE(sc, ATW_TDR, 0x1);		/* Set a watchdog timer in case the chip flakes out. */		sc->sc_tx_timer = 5;		ifp->if_timer = 1;	}}