Index: madwifi-ng-r2568-20070710/ath/if_ath.c
===================================================================
--- madwifi-ng-r2568-20070710.orig/ath/if_ath.c	2007-07-11 22:59:44.896407046 +0200
+++ madwifi-ng-r2568-20070710/ath/if_ath.c	2007-07-11 22:59:45.332431894 +0200
@@ -2558,7 +2558,7 @@
 	/* NB: use this lock to protect an->an_tx_ffbuf (and txq->axq_stageq)
 	 *	in athff_can_aggregate() call too.
 	 */
-	ATH_TXQ_LOCK_IRQ(txq);
+	ATH_TXQ_LOCK_BH(txq);
 	if (athff_can_aggregate(sc, eh, an, skb, vap->iv_fragthreshold, &ff_flush)) {
 		if (an->an_tx_ffbuf[skb->priority]) { /* i.e., frame on the staging queue */
 			bf = an->an_tx_ffbuf[skb->priority];
@@ -2566,6 +2566,7 @@
 			/* get (and remove) the frame from staging queue */
 			TAILQ_REMOVE(&txq->axq_stageq, bf, bf_stagelist);
 			an->an_tx_ffbuf[skb->priority] = NULL;
+			ATH_TXQ_UNLOCK_BH(txq);
 
 			/*
 			 * chain skbs and add FF magic
@@ -2588,7 +2589,7 @@
 			 */
 			ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
 			if (bf == NULL) {
-				ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+				ATH_TXQ_UNLOCK_BH(txq);
 				goto hardstart_fail;
 			}
 			DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
@@ -2600,8 +2601,7 @@
 			an->an_tx_ffbuf[skb->priority] = bf;
 
 			TAILQ_INSERT_HEAD(&txq->axq_stageq, bf, bf_stagelist);
-
-			ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+			ATH_TXQ_UNLOCK_BH(txq);
 
 			return NETDEV_TX_OK;
 		}
@@ -2614,7 +2614,7 @@
 			an->an_tx_ffbuf[skb->priority] = NULL;
 
 			/* NB: ath_tx_start -> ath_tx_txqaddbuf uses ATH_TXQ_LOCK too */
-			ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+			ATH_TXQ_UNLOCK_BH(txq);
 
 			/* encap and xmit */
 			bf_ff->bf_skb = ieee80211_encap(ni, bf_ff->bf_skb, &framecnt);
@@ -2663,12 +2663,12 @@
 
 		ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
 		if (bf == NULL) {
-			ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+			ATH_TXQ_UNLOCK_BH(txq);
 			goto hardstart_fail;
 		}
+		ATH_TXQ_UNLOCK_BH(txq);
 	}
 
-	ATH_TXQ_UNLOCK_IRQ(txq);
 
 ff_flush_done:
 ff_bypass:
Index: madwifi-ng-r2568-20070710/ath/if_athvar.h
===================================================================
--- madwifi-ng-r2568-20070710.orig/ath/if_athvar.h	2007-07-11 22:59:44.896407046 +0200
+++ madwifi-ng-r2568-20070710/ath/if_athvar.h	2007-07-11 22:59:45.332431894 +0200
@@ -497,6 +497,8 @@
 #define ATH_TXQ_INTR_PERIOD		5  /* axq_intrcnt period for intr gen */
 #define	ATH_TXQ_LOCK_INIT(_tq)		spin_lock_init(&(_tq)->axq_lock)
 #define	ATH_TXQ_LOCK_DESTROY(_tq)
+#define ATH_TXQ_LOCK_BH(_tq)		spin_lock_bh(&(_tq)->axq_lock);
+#define ATH_TXQ_UNLOCK_BH(_tq)		spin_unlock_bh(&(_tq)->axq_lock);
 #define ATH_TXQ_LOCK_IRQ(_tq)		do {				\
 	unsigned long __axq_lockflags;					\
 	spin_lock_irqsave(&(_tq)->axq_lock, __axq_lockflags);