--- /dev/null
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 24 Sep 2015 14:10:07 +0200
+Subject: [PATCH] mac80211: fix tx sequence number assignment with software
+ queue + fast-xmit
+
+When using software queueing, tx sequence number assignment happens at
+ieee80211_tx_dequeue time, so the fast-xmit codepath must not do that.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2766,7 +2766,8 @@ static bool ieee80211_xmit_fast(struct i
+
+ if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+ *ieee80211_get_qos_ctl(hdr) = tid;
+- hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
++ if (!sta->sta.txq[0])
++ hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
+ } else {
+ info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+ hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
--- /dev/null
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 24 Sep 2015 14:11:40 +0200
+Subject: [PATCH] mac80211: fix handling of PS filtering with fast-xmit
+
+Fixes dropped packets in the tx path in case a non-PS station triggers
+the tx filter.
+
+Cc: stable@vger.kernel.org # 4.2
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -101,6 +101,7 @@ static void ieee80211_handle_filtered_fr
+ * when it wakes up for the next time.
+ */
+ set_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT);
++ ieee80211_clear_fast_xmit(sta);
+
+ /*
+ * This code races in the following way:
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1217,8 +1217,10 @@ ieee80211_tx_prepare(struct ieee80211_su
+
+ if (!tx->sta)
+ info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+- else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
++ else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
+ info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
++ ieee80211_check_fast_xmit(tx->sta);
++ }
+
+ info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
+
+@@ -2450,7 +2452,8 @@ void ieee80211_check_fast_xmit(struct st
+
+ if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
+ test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
+- test_sta_flag(sta, WLAN_STA_PS_DELIVER))
++ test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
++ test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
+ goto out;
+
+ if (sdata->noack_map)