diff --git a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch b/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
index 154d9114576e668016e5ba747ac9c62c41fe6807..5febbf08d193de467337e0d923168a4a9f50982f 100644
--- a/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
+++ b/package/kernel/mac80211/patches/300-mac80211-add-an-intermediate-software-queue-implemen.patch
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -84,6 +84,34 @@
+@@ -84,6 +84,35 @@
   *
   */
  
@@ -46,15 +46,16 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 + * For AP powersave TIM handling, the driver only needs to indicate if it has
 + * buffered packets in the driver specific data structures by calling
 + * ieee80211_sta_set_buffered(). For frames buffered in the ieee80211_txq
-+ * struct, mac80211 sets TIM and calls .release_buffered_frames().
-+ * The driver is expected to release its own buffered frames and also call
-+ * ieee80211_tx_dequeue() within that callback.
++ * struct, mac80211 sets the appropriate TIM PVB bits and calls
++ * .release_buffered_frames().
++ * That callback is expected to release its own buffered frames and afterwards
++ * also frames from the ieee80211_txq (obtained via ieee80211_tx_dequeue).
 + */
 +
  struct device;
  
  /**
-@@ -1257,6 +1285,8 @@ struct ieee80211_vif {
+@@ -1257,6 +1286,8 @@ struct ieee80211_vif {
  	u8 cab_queue;
  	u8 hw_queue[IEEE80211_NUM_ACS];
  
@@ -63,7 +64,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	struct ieee80211_chanctx_conf __rcu *chanctx_conf;
  
  	u32 driver_flags;
-@@ -1519,6 +1549,8 @@ struct ieee80211_sta {
+@@ -1519,6 +1550,8 @@ struct ieee80211_sta {
  	bool tdls_initiator;
  	bool mfp;
  
@@ -72,14 +73,14 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	/* must be last */
  	u8 drv_priv[0] __aligned(sizeof(void *));
  };
-@@ -1547,6 +1579,27 @@ struct ieee80211_tx_control {
+@@ -1547,6 +1580,27 @@ struct ieee80211_tx_control {
  };
  
  /**
 + * struct ieee80211_txq - Software intermediate tx queue
 + *
 + * @vif: &struct ieee80211_vif pointer from the add_interface callback.
-+ * @sta: station table entry, may be NULL for per-vif queue
++ * @sta: station table entry, %NULL for per-vif queue
 + * @tid: the TID for this queue (unused for per-vif queue)
 + * @ac: the AC for this queue
 + *
@@ -100,7 +101,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   * enum ieee80211_hw_flags - hardware flags
   *
   * These flags are used to indicate hardware capabilities to
-@@ -1770,6 +1823,8 @@ enum ieee80211_hw_flags {
+@@ -1770,6 +1824,8 @@ enum ieee80211_hw_flags {
   *	within &struct ieee80211_sta.
   * @chanctx_data_size: size (in bytes) of the drv_priv data area
   *	within &struct ieee80211_chanctx_conf.
@@ -109,7 +110,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   *
   * @max_rates: maximum number of alternate rate retry stages the hw
   *	can handle.
-@@ -1818,6 +1873,9 @@ enum ieee80211_hw_flags {
+@@ -1818,6 +1874,9 @@ enum ieee80211_hw_flags {
   * @n_cipher_schemes: a size of an array of cipher schemes definitions.
   * @cipher_schemes: a pointer to an array of cipher scheme definitions
   *	supported by HW.
@@ -119,7 +120,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   */
  struct ieee80211_hw {
  	struct ieee80211_conf conf;
-@@ -1830,6 +1888,7 @@ struct ieee80211_hw {
+@@ -1830,6 +1889,7 @@ struct ieee80211_hw {
  	int vif_data_size;
  	int sta_data_size;
  	int chanctx_data_size;
@@ -127,7 +128,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	u16 queues;
  	u16 max_listen_interval;
  	s8 max_signal;
-@@ -1846,6 +1905,7 @@ struct ieee80211_hw {
+@@ -1846,6 +1906,7 @@ struct ieee80211_hw {
  	u8 uapsd_max_sp_len;
  	u8 n_cipher_schemes;
  	const struct ieee80211_cipher_scheme *cipher_schemes;
@@ -135,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  };
  
  /**
-@@ -3007,6 +3067,8 @@ enum ieee80211_reconfig_type {
+@@ -3007,6 +3068,8 @@ enum ieee80211_reconfig_type {
   *	response template is provided, together with the location of the
   *	switch-timing IE within the template. The skb can only be used within
   *	the function call.
@@ -144,7 +145,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
   */
  struct ieee80211_ops {
  	void (*tx)(struct ieee80211_hw *hw,
-@@ -3238,6 +3300,9 @@ struct ieee80211_ops {
+@@ -3238,6 +3301,9 @@ struct ieee80211_ops {
  	void (*tdls_recv_channel_switch)(struct ieee80211_hw *hw,
  					 struct ieee80211_vif *vif,
  					 struct ieee80211_tdls_ch_sw_params *params);
@@ -154,7 +155,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  };
  
  /**
-@@ -5249,4 +5314,17 @@ void ieee80211_unreserve_tid(struct ieee
+@@ -5249,4 +5315,17 @@ void ieee80211_unreserve_tid(struct ieee
   */
  size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
  			  const u8 *ids, int n_ids, size_t offset);
@@ -165,7 +166,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 + * @hw: pointer as obtained from ieee80211_alloc_hw()
 + * @txq: pointer obtained from .add_tx_queue() call
 + *
-+ * Returns the skb if successful, NULL if no frame was available.
++ * Returns the skb if successful, %NULL if no frame was available.
 + */
 +struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 +				     struct ieee80211_txq *txq);
@@ -232,32 +233,33 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
  {
-@@ -1905,6 +1923,12 @@ static inline bool ieee80211_can_run_wor
+@@ -1905,6 +1923,9 @@ static inline bool ieee80211_can_run_wor
  	return true;
  }
  
 +void ieee80211_init_tx_queue(struct ieee80211_sub_if_data *sdata,
 +			     struct sta_info *sta,
 +			     struct txq_info *txq, int tid);
-+void ieee80211_flush_tx_queue(struct ieee80211_local *local,
-+			      struct ieee80211_txq *txq);
-+
  void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
  			 u16 transaction, u16 auth_alg, u16 status,
  			 const u8 *extra, size_t extra_len, const u8 *bssid,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -969,6 +969,9 @@ static void ieee80211_do_stop(struct iee
+@@ -969,6 +969,13 @@ static void ieee80211_do_stop(struct iee
  	}
  	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
-+	if (sdata->vif.txq)
-+		ieee80211_flush_tx_queue(local, sdata->vif.txq);
++	if (sdata->vif.txq) {
++		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
++
++		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
++		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
++	}
 +
  	if (local->open_count == 0)
  		ieee80211_clear_tx_pending(local);
  
-@@ -1773,6 +1776,15 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -1773,6 +1780,15 @@ int ieee80211_if_add(struct ieee80211_lo
  	ieee80211_setup_sdata(sdata, type);
  
  	if (ndev) {
@@ -273,7 +275,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		if (params) {
  			ndev->ieee80211_ptr->use_4addr = params->use_4addr;
  			if (type == NL80211_IFTYPE_STATION)
-@@ -1785,6 +1797,7 @@ int ieee80211_if_add(struct ieee80211_lo
+@@ -1785,6 +1801,7 @@ int ieee80211_if_add(struct ieee80211_lo
  
  		ret = register_netdevice(ndev);
  		if (ret) {
@@ -281,7 +283,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			free_netdev(ndev);
  			return ret;
  		}
-@@ -1810,6 +1823,9 @@ void ieee80211_if_remove(struct ieee8021
+@@ -1810,6 +1827,9 @@ void ieee80211_if_remove(struct ieee8021
  
  	synchronize_rcu();
  
@@ -291,7 +293,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	if (sdata->dev) {
  		unregister_netdevice(sdata->dev);
  	} else {
-@@ -1851,6 +1867,9 @@ void ieee80211_remove_interfaces(struct 
+@@ -1851,6 +1871,9 @@ void ieee80211_remove_interfaces(struct 
  	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
  		list_del(&sdata->list);
  
@@ -315,19 +317,24 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -118,6 +118,11 @@ static void __cleanup_single_sta(struct 
+@@ -118,6 +118,16 @@ static void __cleanup_single_sta(struct 
  		atomic_dec(&ps->num_sta_ps);
  	}
  
 +	if (sta->sta.txq[0]) {
-+		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++)
-+			ieee80211_flush_tx_queue(local, sta->sta.txq[i]);
++		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
++			struct txq_info *txqi = to_txq_info(sta->sta.txq[i]);
++			int n = skb_queue_len(&txqi->queue);
++
++			ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
++			atomic_sub(n, &sdata->txqs_len[txqi->txq.ac]);
++		}
 +	}
 +
  	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
  		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
  		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
-@@ -234,6 +239,8 @@ void sta_info_free(struct ieee80211_loca
+@@ -234,6 +244,8 @@ void sta_info_free(struct ieee80211_loca
  
  	sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
  
@@ -336,7 +343,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	kfree(rcu_dereference_raw(sta->sta.rates));
  	kfree(sta);
  }
-@@ -285,11 +292,12 @@ struct sta_info *sta_info_alloc(struct i
+@@ -285,11 +297,12 @@ struct sta_info *sta_info_alloc(struct i
  				const u8 *addr, gfp_t gfp)
  {
  	struct ieee80211_local *local = sdata->local;
@@ -350,7 +357,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	if (!sta)
  		return NULL;
  
-@@ -321,11 +329,24 @@ struct sta_info *sta_info_alloc(struct i
+@@ -321,11 +334,25 @@ struct sta_info *sta_info_alloc(struct i
  	for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
  		ewma_init(&sta->chain_signal_avg[i], 1024, 8);
  
@@ -368,6 +375,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +
 +		for (i = 0; i < ARRAY_SIZE(sta->sta.txq); i++) {
 +			struct txq_info *txq = txq_data + i * size;
++
 +			ieee80211_init_tx_queue(sdata, sta, txq, i);
 +		}
  	}
@@ -378,7 +386,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
  		/*
  		 * timer_to_tid must be initialized with identity mapping
-@@ -346,7 +367,7 @@ struct sta_info *sta_info_alloc(struct i
+@@ -346,7 +373,7 @@ struct sta_info *sta_info_alloc(struct i
  	if (sdata->vif.type == NL80211_IFTYPE_AP ||
  	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
  		struct ieee80211_supported_band *sband =
@@ -387,7 +395,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		u8 smps = (sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >>
  				IEEE80211_HT_CAP_SM_PS_SHIFT;
  		/*
-@@ -371,6 +392,13 @@ struct sta_info *sta_info_alloc(struct i
+@@ -371,6 +398,13 @@ struct sta_info *sta_info_alloc(struct i
  	sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
  
  	return sta;
@@ -401,7 +409,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  }
  
  static int sta_info_insert_check(struct sta_info *sta)
-@@ -640,6 +668,8 @@ static void __sta_info_recalc_tim(struct
+@@ -640,6 +674,8 @@ static void __sta_info_recalc_tim(struct
  
  		indicate_tim |=
  			sta->driver_buffered_tids & tids;
@@ -410,7 +418,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	}
  
   done:
-@@ -1071,7 +1101,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1071,7 +1107,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
  	struct ieee80211_sub_if_data *sdata = sta->sdata;
  	struct ieee80211_local *local = sdata->local;
  	struct sk_buff_head pending;
@@ -419,7 +427,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	unsigned long flags;
  	struct ps_data *ps;
  
-@@ -1090,10 +1120,22 @@ void ieee80211_sta_ps_deliver_wakeup(str
+@@ -1090,10 +1126,22 @@ void ieee80211_sta_ps_deliver_wakeup(str
  
  	BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
  	sta->driver_buffered_tids = 0;
@@ -442,7 +450,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	skb_queue_head_init(&pending);
  
  	/* sync with ieee80211_tx_h_unicast_ps_buf */
-@@ -1254,7 +1296,7 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1254,7 +1302,7 @@ ieee80211_sta_ps_deliver_response(struct
  	struct ieee80211_sub_if_data *sdata = sta->sdata;
  	struct ieee80211_local *local = sdata->local;
  	bool more_data = false;
@@ -451,7 +459,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	unsigned long driver_release_tids = 0;
  	struct sk_buff_head frames;
  
-@@ -1275,8 +1317,10 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1275,8 +1323,10 @@ ieee80211_sta_ps_deliver_response(struct
  		/* if we already have frames from software, then we can't also
  		 * release from hardware queues
  		 */
@@ -463,7 +471,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  		if (driver_release_tids) {
  			/* If the driver has data on more than one TID then
-@@ -1447,6 +1491,8 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1447,6 +1497,8 @@ ieee80211_sta_ps_deliver_response(struct
  
  		sta_info_recalc_tim(sta);
  	} else {
@@ -472,7 +480,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		/*
  		 * We need to release a frame that is buffered somewhere in the
  		 * driver ... it'll have to handle that.
-@@ -1466,8 +1512,22 @@ ieee80211_sta_ps_deliver_response(struct
+@@ -1466,8 +1518,22 @@ ieee80211_sta_ps_deliver_response(struct
  		 * that the TID(s) became empty before returning here from the
  		 * release function.
  		 * Either way, however, when the driver tells us that the TID(s)
@@ -603,7 +611,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		spin_lock(&tx->sta->lock);
  		/*
  		 * Need to re-check now, because we may get here
-@@ -1201,13 +1209,101 @@ ieee80211_tx_prepare(struct ieee80211_su
+@@ -1201,13 +1209,102 @@ ieee80211_tx_prepare(struct ieee80211_su
  	return TX_CONTINUE;
  }
  
@@ -630,6 +638,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +
 +	if (pubsta) {
 +		u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
++
 +		txq = pubsta->txq[tid];
 +	} else if (vif) {
 +		txq = vif->txq;
@@ -639,7 +648,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		goto tx_normal;
 +
 +	ac = txq->ac;
-+	txqi = container_of(txq, struct txq_info, txq);
++	txqi = to_txq_info(txq);
 +	atomic_inc(&sdata->txqs_len[ac]);
 +	if (atomic_read(&sdata->txqs_len[ac]) >= local->hw.txq_ac_max_pending)
 +		netif_stop_subqueue(sdata->dev, ac);
@@ -706,7 +715,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	struct sk_buff *skb, *tmp;
  	unsigned long flags;
  
-@@ -1265,10 +1361,9 @@ static bool ieee80211_tx_frags(struct ie
+@@ -1265,10 +1362,9 @@ static bool ieee80211_tx_frags(struct ie
  		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
  		info->control.vif = vif;
@@ -732,7 +741,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  			if (ac_queue == queue ||
  			    (sdata->vif.cab_queue == queue &&
  			     local->queue_stop_reasons[ac_queue] == 0 &&
-@@ -3307,3 +3312,36 @@ u8 *ieee80211_add_wmm_info_ie(u8 *buf, u
+@@ -3307,3 +3312,20 @@ u8 *ieee80211_add_wmm_info_ie(u8 *buf, u
  
  	return buf;
  }
@@ -753,22 +762,6 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		txqi->txq.ac = IEEE80211_AC_BE;
 +	}
 +}
-+
-+void ieee80211_flush_tx_queue(struct ieee80211_local *local,
-+			      struct ieee80211_txq *txq)
-+{
-+	struct txq_info *txqi = container_of(txq, struct txq_info, txq);
-+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
-+	struct sk_buff *skb;
-+	int n = 0;
-+
-+	while ((skb = skb_dequeue(&txqi->queue)) != NULL) {
-+		n++;
-+		ieee80211_free_txskb(&local->hw, skb);
-+	}
-+
-+	atomic_sub(n, &sdata->txqs_len[txq->ac]);
-+}
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
 @@ -1176,6 +1176,7 @@ static void sta_ps_start(struct sta_info
@@ -800,7 +793,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  static void sta_ps_end(struct sta_info *sta)
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
-@@ -188,6 +188,41 @@ ieee80211_wake_queue_agg(struct ieee8021
+@@ -188,6 +188,43 @@ ieee80211_wake_queue_agg(struct ieee8021
  	__release(agg_queue);
  }
  
@@ -814,6 +807,8 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
 +		return;
 +
 +	txqi = to_txq_info(txq);
++
++	/* Lock here to protect against further seqno updates on dequeue */
 +	spin_lock_bh(&txqi->queue.lock);
 +	set_bit(IEEE80211_TXQ_STOP, &txqi->flags);
 +	spin_unlock_bh(&txqi->queue.lock);
@@ -842,7 +837,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  /*
   * splice packets from the STA's pending to the local pending,
   * requires a call to ieee80211_agg_splice_finish later
-@@ -247,6 +282,7 @@ static void ieee80211_remove_tid_tx(stru
+@@ -247,6 +284,7 @@ static void ieee80211_remove_tid_tx(stru
  	ieee80211_assign_tid_tx(sta, tid, NULL);
  
  	ieee80211_agg_splice_finish(sta->sdata, tid);
@@ -850,7 +845,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  
  	kfree_rcu(tid_tx, rcu_head);
  }
-@@ -418,6 +454,8 @@ void ieee80211_tx_ba_session_handle_star
+@@ -418,6 +456,8 @@ void ieee80211_tx_ba_session_handle_star
  	 */
  	clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
  
@@ -859,7 +854,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  	/*
  	 * Make sure no packets are being processed. This ensures that
  	 * we have a valid starting sequence number and that in-flight
-@@ -440,6 +478,8 @@ void ieee80211_tx_ba_session_handle_star
+@@ -440,6 +480,8 @@ void ieee80211_tx_ba_session_handle_star
  		ieee80211_agg_splice_finish(sdata, tid);
  		spin_unlock_bh(&sta->lock);
  
@@ -868,7 +863,7 @@ Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  		kfree_rcu(tid_tx, rcu_head);
  		return;
  	}
-@@ -666,6 +706,8 @@ static void ieee80211_agg_tx_operational
+@@ -666,6 +708,8 @@ static void ieee80211_agg_tx_operational
  	ieee80211_agg_splice_finish(sta->sdata, tid);
  
  	spin_unlock_bh(&sta->lock);
diff --git a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch b/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
index 53d981b9e9a414b7b061e22b6c723802475dcedf..465d94319df031e88c960312b55d8bfee8b3b6cf 100644
--- a/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
+++ b/package/kernel/mac80211/patches/301-mac80211-lock-rate-control.patch
@@ -104,7 +104,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  static inline void rate_control_free_sta(struct sta_info *sta)
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -281,7 +281,7 @@ static int sta_prepare_rate_control(stru
+@@ -286,7 +286,7 @@ static int sta_prepare_rate_control(stru
  
  	sta->rate_ctrl = local->rate_ctrl;
  	sta->rate_ctrl_priv = rate_control_alloc_sta(sta->rate_ctrl,
diff --git a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
index 486b0719c8b4685b7b5bd4c396611f09922b8563..673c6dc4226e47734f38d7774326ab18a0250020 100644
--- a/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/522-mac80211_configure_antenna_gain.patch
@@ -18,7 +18,7 @@
  				const u8 *addr);
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1166,6 +1166,7 @@ enum ieee80211_smps_mode {
+@@ -1167,6 +1167,7 @@ enum ieee80211_smps_mode {
   *
   * @power_level: requested transmit power (in dBm), backward compatibility
   *	value only that is set to the minimum of all interfaces
@@ -26,7 +26,7 @@
   *
   * @chandef: the channel definition to tune to
   * @radar_enabled: whether radar detection is enabled
-@@ -1187,6 +1188,7 @@ struct ieee80211_conf {
+@@ -1188,6 +1189,7 @@ struct ieee80211_conf {
  	u32 flags;
  	int power_level, dynamic_ps_timeout;
  	int max_sleep_period;