#include <linux/spinlock.h>
 #include <linux/string.h>
 #include <net/mac80211.h>
+#include "wme.h"
 #include "ieee80211_i.h"
 #include "mesh.h"
 
        struct ieee80211_hdr *hdr;
        struct sk_buff_head tmpq;
        unsigned long flags;
+       struct ieee80211_sub_if_data *sdata = mpath->sdata;
 
        rcu_assign_pointer(mpath->next_hop, sta);
 
        while ((skb = __skb_dequeue(&mpath->frame_queue)) != NULL) {
                hdr = (struct ieee80211_hdr *) skb->data;
                memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
+               skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
+               ieee80211_set_qos_hdr(sdata->local, skb);
                __skb_queue_tail(&tmpq, skb);
        }
 
 
                        memset(info, 0, sizeof(*info));
                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                        info->control.vif = &rx->sdata->vif;
-                       skb_set_queue_mapping(skb,
-                               ieee80211_select_queue(rx->sdata, fwd_skb));
-                       ieee80211_set_qos_hdr(local, skb);
-                       if (is_multicast_ether_addr(fwd_hdr->addr1))
+                       if (is_multicast_ether_addr(fwd_hdr->addr1)) {
                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                                fwded_mcast);
-                       else {
+                               skb_set_queue_mapping(fwd_skb,
+                                       ieee80211_select_queue(sdata, fwd_skb));
+                               ieee80211_set_qos_hdr(local, fwd_skb);
+                       } else {
                                int err;
                                /*
                                 * Save TA to addr1 to send TA a path error if a
 
                rcu_read_unlock();
        }
 
+       /* For mesh, the use of the QoS header is mandatory */
+       if (ieee80211_vif_is_mesh(&sdata->vif))
+               sta_flags |= WLAN_STA_WME;
+
        /* receiver and we are QoS enabled, use a QoS type frame */
        if ((sta_flags & WLAN_STA_WME) && local->hw.queues >= 4) {
                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 
                break;
 #ifdef CONFIG_MAC80211_MESH
        case NL80211_IFTYPE_MESH_POINT:
-               /*
-                * XXX: This is clearly broken ... but already was before,
-                * because ieee80211_fill_mesh_addresses() would clear A1
-                * except for multicast addresses.
-                */
+               ra = skb->data;
                break;
 #endif
        case NL80211_IFTYPE_STATION: