diff --git a/target/linux/brcm47xx/patches-2.6.34/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-2.6.34/820-wgt634u-nvram-fix.patch
new file mode 100644
index 000000000..9ed4a4de4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-2.6.34/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,305 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/arch/mips/bcm47xx/Makefile
++++ b/arch/mips/bcm47xx/Makefile
+@@ -3,4 +3,4 @@
+ # under Linux.
+ #
+ 
+-obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
++obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o cfe_env.o
+--- /dev/null
++++ b/arch/mips/bcm47xx/cfe_env.c
+@@ -0,0 +1,229 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char* 
++cfe_env_get(unsigned char *nv_buf, char* name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -21,6 +21,8 @@
+ #include <asm/mach-bcm47xx/bcm47xx.h>
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ /* Probe for NVRAM header */
+ static void __init early_nvram_init(void)
+@@ -33,6 +35,25 @@ static void __init early_nvram_init(void
+ 
+ 	base = mcore->flash_window;
+ 	lim = mcore->flash_window_size;
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (lim >= 8 * 1024 * 1024) {
++		src = (u32 *) KSEG1ADDR(base + 8 * 1024 * 1024 - 0x2000);
++		dst = (u32 *) nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return;
++		}
++	}
+ 
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+@@ -74,6 +95,12 @@ int nvram_getenv(char *name, char *val,
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		snprintf(val, val_len, "%s", value);
++		return 0;
++	}
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
+@@ -103,6 +130,9 @@ char *nvram_get(const char *name)
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env)
++		return cfe_env_get(nvram_buf, name);
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
diff --git a/target/linux/brcm47xx/patches-2.6.34/999-wl_exports.patch b/target/linux/brcm47xx/patches-2.6.34/999-wl_exports.patch
index ecc796aaf..b4f264e5e 100644
--- a/target/linux/brcm47xx/patches-2.6.34/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-2.6.34/999-wl_exports.patch
@@ -7,9 +7,9 @@
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
+ static int cfe_env;
+ extern char *cfe_env_get(char *nv_buf, const char *name);
  
- /* Probe for NVRAM header */
- static void __init early_nvram_init(void)
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
 @@ -52,6 +52,7 @@ void (*_dma_cache_wback)(unsigned long s
diff --git a/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch b/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch
index cb2f4e097..72187a58d 100644
--- a/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/015-MIPS-BCM47xx-nvram_getenv-fix-return-value.patch
@@ -15,7 +15,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -69,7 +69,7 @@ int nvram_getenv(char *name, char *val, 
+@@ -69,7 +69,7 @@ int nvram_getenv(char *name, char *val,
  	char *var, *value, *end, *eq;
  
  	if (!name)
@@ -24,7 +24,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  	if (!nvram_buf[0])
  		early_nvram_init();
-@@ -89,6 +89,6 @@ int nvram_getenv(char *name, char *val, 
+@@ -89,6 +89,6 @@ int nvram_getenv(char *name, char *val,
  			return 0;
  		}
  	}
diff --git a/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch b/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch
index 4dedb8218..f333d71d8 100644
--- a/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/211-b44_timeout_spam.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
-@@ -188,10 +188,11 @@ static int b44_wait_bit(struct b44 *bp, 
+@@ -188,10 +188,11 @@ static int b44_wait_bit(struct b44 *bp,
  		udelay(10);
  	}
  	if (i == timeout) {
diff --git a/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch b/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch
index af2289b08..27d5409d2 100644
--- a/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/310-no_highpage.patch
@@ -8,7 +8,7 @@
  #include <asm/io.h>
  
  extern void build_clear_page(void);
-@@ -78,13 +79,16 @@ static inline void clear_user_page(void 
+@@ -78,13 +79,16 @@ static inline void clear_user_page(void
  		flush_data_cache_page((unsigned long)addr);
  }
  
diff --git a/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch b/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch
index 1db97e5e4..afaea44c7 100644
--- a/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/400-arch-bcm47xx.patch
@@ -1,7 +1,7 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -92,3 +92,30 @@ int nvram_getenv(char *name, char *val, 
- 	return -1;
+@@ -92,3 +92,30 @@ int nvram_getenv(char *name, char *val,
+ 	return NVRAM_ERR_ENVNOTFOUND;
  }
  EXPORT_SYMBOL(nvram_getenv);
 +
diff --git a/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch b/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch
index 29b1a9da1..5621b7329 100644
--- a/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/700-ssb-gigabit-ethernet-driver.patch
@@ -8,7 +8,7 @@
  
  #include <net/checksum.h>
  #include <net/ip.h>
-@@ -494,8 +495,9 @@ static void _tw32_flush(struct tg3 *tp, 
+@@ -494,8 +495,9 @@ static void _tw32_flush(struct tg3 *tp,
  static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
  {
  	tp->write32_mbox(tp, off, val);
@@ -61,7 +61,7 @@
  {
  	u32 frame_val;
  	unsigned int loops;
-@@ -872,7 +879,7 @@ static int tg3_writephy(struct tg3 *tp, 
+@@ -872,7 +879,7 @@ static int tg3_writephy(struct tg3 *tp,
  		udelay(80);
  	}
  
@@ -70,7 +70,7 @@
  		      MI_COM_PHY_ADDR_MASK);
  	frame_val |= ((reg << MI_COM_REG_ADDR_SHIFT) &
  		      MI_COM_REG_ADDR_MASK);
-@@ -905,6 +912,11 @@ static int tg3_writephy(struct tg3 *tp, 
+@@ -905,6 +912,11 @@ static int tg3_writephy(struct tg3 *tp,
  	return ret;
  }
  
@@ -147,7 +147,7 @@
  	tw32(GRC_MODE, tp->grc_mode);
  
  	if (tp->pci_chip_rev_id == CHIPREV_ID_5705_A0) {
-@@ -7179,9 +7217,12 @@ static int tg3_halt_cpu(struct tg3 *tp, 
+@@ -7179,9 +7217,12 @@ static int tg3_halt_cpu(struct tg3 *tp,
  		return -ENODEV;
  	}
  
@@ -175,7 +175,7 @@
  	fw_data = (void *)tp->fw->data;
  
  	/* Firmware blob starts with version numbers, followed by
-@@ -7302,6 +7348,11 @@ static int tg3_load_tso_firmware(struct 
+@@ -7302,6 +7348,11 @@ static int tg3_load_tso_firmware(struct
  	unsigned long cpu_base, cpu_scratch_base, cpu_scratch_size;
  	int err, i;
  
@@ -242,7 +242,7 @@
  	tw32_f(GRC_EEPROM_ADDR,
  	     (EEPROM_ADDR_FSM_RESET |
  	      (EEPROM_DEFAULT_CLOCK_PERIOD <<
-@@ -11855,6 +11922,9 @@ static int tg3_nvram_write_block(struct 
+@@ -11855,6 +11922,9 @@ static int tg3_nvram_write_block(struct
  {
  	int ret;
  
diff --git a/target/linux/brcm47xx/patches-2.6.35/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-2.6.35/820-wgt634u-nvram-fix.patch
new file mode 100644
index 000000000..9ed4a4de4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-2.6.35/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,305 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/arch/mips/bcm47xx/Makefile
++++ b/arch/mips/bcm47xx/Makefile
+@@ -3,4 +3,4 @@
+ # under Linux.
+ #
+ 
+-obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
++obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o cfe_env.o
+--- /dev/null
++++ b/arch/mips/bcm47xx/cfe_env.c
+@@ -0,0 +1,229 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char* 
++cfe_env_get(unsigned char *nv_buf, char* name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -21,6 +21,8 @@
+ #include <asm/mach-bcm47xx/bcm47xx.h>
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ /* Probe for NVRAM header */
+ static void __init early_nvram_init(void)
+@@ -33,6 +35,25 @@ static void __init early_nvram_init(void
+ 
+ 	base = mcore->flash_window;
+ 	lim = mcore->flash_window_size;
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (lim >= 8 * 1024 * 1024) {
++		src = (u32 *) KSEG1ADDR(base + 8 * 1024 * 1024 - 0x2000);
++		dst = (u32 *) nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return;
++		}
++	}
+ 
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+@@ -74,6 +95,12 @@ int nvram_getenv(char *name, char *val,
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		snprintf(val, val_len, "%s", value);
++		return 0;
++	}
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
+@@ -103,6 +130,9 @@ char *nvram_get(const char *name)
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env)
++		return cfe_env_get(nvram_buf, name);
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
diff --git a/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch b/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch
index b45e62a01..7341d7929 100644
--- a/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/940-bcm47xx-yenta.patch
@@ -28,7 +28,7 @@
  	dev_printk(KERN_INFO, &socket->dev->dev,
  		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
  		   socket->socket.irq_mask, socket->cb_irq);
-@@ -1259,6 +1266,15 @@ static int __devinit yenta_probe(struct 
+@@ -1259,6 +1266,15 @@ static int __devinit yenta_probe(struct
  	dev_printk(KERN_INFO, &dev->dev,
  		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
  
diff --git a/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch b/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch
index ecc796aaf..b4f264e5e 100644
--- a/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-2.6.35/999-wl_exports.patch
@@ -7,9 +7,9 @@
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
+ static int cfe_env;
+ extern char *cfe_env_get(char *nv_buf, const char *name);
  
- /* Probe for NVRAM header */
- static void __init early_nvram_init(void)
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
 @@ -52,6 +52,7 @@ void (*_dma_cache_wback)(unsigned long s
diff --git a/target/linux/brcm47xx/patches-2.6.36/016-MIPS-BCM47xx-Remove-CFE-console.patch b/target/linux/brcm47xx/patches-2.6.36/016-MIPS-BCM47xx-Remove-CFE-console.patch
index ef36709c0..7183bfd3d 100644
--- a/target/linux/brcm47xx/patches-2.6.36/016-MIPS-BCM47xx-Remove-CFE-console.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/016-MIPS-BCM47xx-Remove-CFE-console.patch
@@ -16,7 +16,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -76,7 +76,6 @@ config BCM47XX
+@@ -77,7 +77,6 @@ config BCM47XX
  	select SSB_B43_PCI_BRIDGE if PCI
  	select SSB_PCICORE_HOSTMODE if PCI
  	select GENERIC_GPIO
diff --git a/target/linux/brcm47xx/patches-2.6.36/211-b44_timeout_spam.patch b/target/linux/brcm47xx/patches-2.6.36/211-b44_timeout_spam.patch
index 4dedb8218..f333d71d8 100644
--- a/target/linux/brcm47xx/patches-2.6.36/211-b44_timeout_spam.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/211-b44_timeout_spam.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/b44.c
 +++ b/drivers/net/b44.c
-@@ -188,10 +188,11 @@ static int b44_wait_bit(struct b44 *bp, 
+@@ -188,10 +188,11 @@ static int b44_wait_bit(struct b44 *bp,
  		udelay(10);
  	}
  	if (i == timeout) {
diff --git a/target/linux/brcm47xx/patches-2.6.36/310-no_highpage.patch b/target/linux/brcm47xx/patches-2.6.36/310-no_highpage.patch
index af2289b08..27d5409d2 100644
--- a/target/linux/brcm47xx/patches-2.6.36/310-no_highpage.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/310-no_highpage.patch
@@ -8,7 +8,7 @@
  #include <asm/io.h>
  
  extern void build_clear_page(void);
-@@ -78,13 +79,16 @@ static inline void clear_user_page(void 
+@@ -78,13 +79,16 @@ static inline void clear_user_page(void
  		flush_data_cache_page((unsigned long)addr);
  }
  
diff --git a/target/linux/brcm47xx/patches-2.6.36/400-arch-bcm47xx.patch b/target/linux/brcm47xx/patches-2.6.36/400-arch-bcm47xx.patch
index 5c0e6ff68..afaea44c7 100644
--- a/target/linux/brcm47xx/patches-2.6.36/400-arch-bcm47xx.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/400-arch-bcm47xx.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm47xx/nvram.c
 +++ b/arch/mips/bcm47xx/nvram.c
-@@ -92,3 +92,30 @@ int nvram_getenv(char *name, char *val, 
+@@ -92,3 +92,30 @@ int nvram_getenv(char *name, char *val,
  	return NVRAM_ERR_ENVNOTFOUND;
  }
  EXPORT_SYMBOL(nvram_getenv);
diff --git a/target/linux/brcm47xx/patches-2.6.36/700-ssb-gigabit-ethernet-driver.patch b/target/linux/brcm47xx/patches-2.6.36/700-ssb-gigabit-ethernet-driver.patch
index fc5454e9a..db7e229e4 100644
--- a/target/linux/brcm47xx/patches-2.6.36/700-ssb-gigabit-ethernet-driver.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/700-ssb-gigabit-ethernet-driver.patch
@@ -8,7 +8,7 @@
  
  #include <net/checksum.h>
  #include <net/ip.h>
-@@ -494,8 +495,9 @@ static void _tw32_flush(struct tg3 *tp, 
+@@ -494,8 +495,9 @@ static void _tw32_flush(struct tg3 *tp,
  static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
  {
  	tp->write32_mbox(tp, off, val);
@@ -61,7 +61,7 @@
  {
  	u32 frame_val;
  	unsigned int loops;
-@@ -889,7 +896,7 @@ static int tg3_writephy(struct tg3 *tp, 
+@@ -889,7 +896,7 @@ static int tg3_writephy(struct tg3 *tp,
  		udelay(80);
  	}
  
@@ -70,7 +70,7 @@
  		      MI_COM_PHY_ADDR_MASK);
  	frame_val |= ((reg << MI_COM_REG_ADDR_SHIFT) &
  		      MI_COM_REG_ADDR_MASK);
-@@ -922,6 +929,11 @@ static int tg3_writephy(struct tg3 *tp, 
+@@ -922,6 +929,11 @@ static int tg3_writephy(struct tg3 *tp,
  	return ret;
  }
  
@@ -147,7 +147,7 @@
  	tw32(GRC_MODE, tp->grc_mode);
  
  	if (tp->pci_chip_rev_id == CHIPREV_ID_5705_A0) {
-@@ -7202,9 +7240,12 @@ static int tg3_halt_cpu(struct tg3 *tp, 
+@@ -7202,9 +7240,12 @@ static int tg3_halt_cpu(struct tg3 *tp,
  		return -ENODEV;
  	}
  
@@ -175,7 +175,7 @@
  	fw_data = (void *)tp->fw->data;
  
  	/* Firmware blob starts with version numbers, followed by
-@@ -7325,6 +7371,11 @@ static int tg3_load_tso_firmware(struct 
+@@ -7325,6 +7371,11 @@ static int tg3_load_tso_firmware(struct
  	unsigned long cpu_base, cpu_scratch_base, cpu_scratch_size;
  	int err, i;
  
@@ -199,7 +199,7 @@
  	if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
  		/* All of this garbage is because when using non-tagged
  		 * IRQ status the mailbox/status_block protocol the chip
-@@ -10131,6 +10187,11 @@ static int tg3_test_nvram(struct tg3 *tp
+@@ -10133,6 +10189,11 @@ static int tg3_test_nvram(struct tg3 *tp
  	if (tp->tg3_flags3 & TG3_FLG3_NO_NVRAM)
  		return 0;
  
@@ -211,7 +211,7 @@
  	if (tg3_nvram_read(tp, 0, &magic) != 0)
  		return -EIO;
  
-@@ -10951,7 +11012,7 @@ static int tg3_ioctl(struct net_device *
+@@ -10953,7 +11014,7 @@ static int tg3_ioctl(struct net_device *
  			return -EAGAIN;
  
  		spin_lock_bh(&tp->lock);
@@ -220,7 +220,7 @@
  		spin_unlock_bh(&tp->lock);
  
  		data->val_out = mii_regval;
-@@ -10967,7 +11028,7 @@ static int tg3_ioctl(struct net_device *
+@@ -10969,7 +11030,7 @@ static int tg3_ioctl(struct net_device *
  			return -EAGAIN;
  
  		spin_lock_bh(&tp->lock);
@@ -229,7 +229,7 @@
  		spin_unlock_bh(&tp->lock);
  
  		return err;
-@@ -11612,6 +11673,12 @@ static void __devinit tg3_get_5717_nvram
+@@ -11614,6 +11675,12 @@ static void __devinit tg3_get_5717_nvram
  /* Chips other than 5700/5701 use the NVRAM for fetching info. */
  static void __devinit tg3_nvram_init(struct tg3 *tp)
  {
@@ -242,7 +242,7 @@
  	tw32_f(GRC_EEPROM_ADDR,
  	     (EEPROM_ADDR_FSM_RESET |
  	      (EEPROM_DEFAULT_CLOCK_PERIOD <<
-@@ -11875,6 +11942,9 @@ static int tg3_nvram_write_block(struct 
+@@ -11877,6 +11944,9 @@ static int tg3_nvram_write_block(struct
  {
  	int ret;
  
@@ -252,7 +252,7 @@
  	if (tp->tg3_flags & TG3_FLAG_EEPROM_WRITE_PROT) {
  		tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl &
  		       ~GRC_LCLCTRL_GPIO_OUTPUT1);
-@@ -13267,6 +13337,11 @@ static int __devinit tg3_get_invariants(
+@@ -13269,6 +13339,11 @@ static int __devinit tg3_get_invariants(
  	      GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)))
  		tp->tg3_flags |= TG3_FLAG_SRAM_USE_CONFIG;
  
@@ -264,7 +264,7 @@
  	/* Get eeprom hw config before calling tg3_set_power_state().
  	 * In particular, the TG3_FLG2_IS_NIC flag must be
  	 * determined before calling tg3_set_power_state() so that
-@@ -13665,6 +13740,10 @@ static int __devinit tg3_get_device_addr
+@@ -13667,6 +13742,10 @@ static int __devinit tg3_get_device_addr
  	}
  
  	if (!is_valid_ether_addr(&dev->dev_addr[0])) {
@@ -275,7 +275,7 @@
  #ifdef CONFIG_SPARC
  		if (!tg3_get_default_macaddr_sparc(tp))
  			return 0;
-@@ -14181,6 +14260,7 @@ static char * __devinit tg3_phy_string(s
+@@ -14183,6 +14262,7 @@ static char * __devinit tg3_phy_string(s
  	case TG3_PHY_ID_BCM5704:	return "5704";
  	case TG3_PHY_ID_BCM5705:	return "5705";
  	case TG3_PHY_ID_BCM5750:	return "5750";
@@ -283,7 +283,7 @@
  	case TG3_PHY_ID_BCM5752:	return "5752";
  	case TG3_PHY_ID_BCM5714:	return "5714";
  	case TG3_PHY_ID_BCM5780:	return "5780";
-@@ -14392,6 +14472,13 @@ static int __devinit tg3_init_one(struct
+@@ -14394,6 +14474,13 @@ static int __devinit tg3_init_one(struct
  		tp->msg_enable = tg3_debug;
  	else
  		tp->msg_enable = TG3_DEF_MSG_ENABLE;
diff --git a/target/linux/brcm47xx/patches-2.6.36/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-2.6.36/820-wgt634u-nvram-fix.patch
new file mode 100644
index 000000000..9ed4a4de4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-2.6.36/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,305 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/arch/mips/bcm47xx/Makefile
++++ b/arch/mips/bcm47xx/Makefile
+@@ -3,4 +3,4 @@
+ # under Linux.
+ #
+ 
+-obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o
++obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o cfe_env.o
+--- /dev/null
++++ b/arch/mips/bcm47xx/cfe_env.c
+@@ -0,0 +1,229 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char* 
++cfe_env_get(unsigned char *nv_buf, char* name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -21,6 +21,8 @@
+ #include <asm/mach-bcm47xx/bcm47xx.h>
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ /* Probe for NVRAM header */
+ static void __init early_nvram_init(void)
+@@ -33,6 +35,25 @@ static void __init early_nvram_init(void
+ 
+ 	base = mcore->flash_window;
+ 	lim = mcore->flash_window_size;
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (lim >= 8 * 1024 * 1024) {
++		src = (u32 *) KSEG1ADDR(base + 8 * 1024 * 1024 - 0x2000);
++		dst = (u32 *) nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return;
++		}
++	}
+ 
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+@@ -74,6 +95,12 @@ int nvram_getenv(char *name, char *val,
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		snprintf(val, val_len, "%s", value);
++		return 0;
++	}
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
+@@ -103,6 +130,9 @@ char *nvram_get(const char *name)
+ 	if (!nvram_buf[0])
+ 		early_nvram_init();
+ 
++	if (cfe_env)
++		return cfe_env_get(nvram_buf, name);
++
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
diff --git a/target/linux/brcm47xx/patches-2.6.36/940-bcm47xx-yenta.patch b/target/linux/brcm47xx/patches-2.6.36/940-bcm47xx-yenta.patch
index d50de3c3d..85e6051f1 100644
--- a/target/linux/brcm47xx/patches-2.6.36/940-bcm47xx-yenta.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/940-bcm47xx-yenta.patch
@@ -28,7 +28,7 @@
  	dev_printk(KERN_INFO, &socket->dev->dev,
  		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
  		   socket->socket.irq_mask, socket->cb_irq);
-@@ -1258,6 +1265,15 @@ static int __devinit yenta_probe(struct 
+@@ -1258,6 +1265,15 @@ static int __devinit yenta_probe(struct
  	dev_printk(KERN_INFO, &dev->dev,
  		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
  
diff --git a/target/linux/brcm47xx/patches-2.6.36/999-wl_exports.patch b/target/linux/brcm47xx/patches-2.6.36/999-wl_exports.patch
index ecc796aaf..b4f264e5e 100644
--- a/target/linux/brcm47xx/patches-2.6.36/999-wl_exports.patch
+++ b/target/linux/brcm47xx/patches-2.6.36/999-wl_exports.patch
@@ -7,9 +7,9 @@
 -static char nvram_buf[NVRAM_SPACE];
 +char nvram_buf[NVRAM_SPACE];
 +EXPORT_SYMBOL(nvram_buf);
+ static int cfe_env;
+ extern char *cfe_env_get(char *nv_buf, const char *name);
  
- /* Probe for NVRAM header */
- static void __init early_nvram_init(void)
 --- a/arch/mips/mm/cache.c
 +++ b/arch/mips/mm/cache.c
 @@ -52,6 +52,7 @@ void (*_dma_cache_wback)(unsigned long s