diff --git a/target/linux/ar71xx/files/drivers/net/ag71xx/ag71xx_main.c b/target/linux/ar71xx/files/drivers/net/ag71xx/ag71xx_main.c
index fc838f45b4..45dd3e52c5 100644
--- a/target/linux/ar71xx/files/drivers/net/ag71xx/ag71xx_main.c
+++ b/target/linux/ar71xx/files/drivers/net/ag71xx/ag71xx_main.c
@@ -685,7 +685,6 @@ static netdev_tx_t ag71xx_hard_start_xmit(struct sk_buff *skb,
 
 static int ag71xx_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-	struct mii_ioctl_data *data = (struct mii_ioctl_data *) &ifr->ifr_data;
 	struct ag71xx *ag = netdev_priv(dev);
 	int ret;
 
@@ -717,7 +716,7 @@ static int ag71xx_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 		if (ag->phy_dev == NULL)
 			break;
 
-		return phy_mii_ioctl(ag->phy_dev, data, cmd);
+		return phy_mii_ioctl(ag->phy_dev, ifr, cmd);
 
 	default:
 		break;
diff --git a/target/linux/ar71xx/files/drivers/spi/ap83_spi.c b/target/linux/ar71xx/files/drivers/spi/ap83_spi.c
index c93070d50a..eada5fe9cb 100644
--- a/target/linux/ar71xx/files/drivers/spi/ap83_spi.c
+++ b/target/linux/ar71xx/files/drivers/spi/ap83_spi.c
@@ -127,33 +127,34 @@ static void ap83_spi_chipselect(struct spi_device *spi, int on)
 
 #define EXPAND_BITBANG_TXRX
 #include <linux/spi/spi_bitbang.h>
+#include "spi_bitbang_txrx.h"
 
 static u32 ap83_spi_txrx_mode0(struct spi_device *spi,
 			       unsigned nsecs, u32 word, u8 bits)
 {
 	dev_dbg(&spi->dev, "TXRX0 word=%08x, bits=%u\n", word, bits);
-	return bitbang_txrx_be_cpha0(spi, nsecs, 0, word, bits);
+	return bitbang_txrx_be_cpha0(spi, nsecs, 0, 0, word, bits);
 }
 
 static u32 ap83_spi_txrx_mode1(struct spi_device *spi,
 			       unsigned nsecs, u32 word, u8 bits)
 {
 	dev_dbg(&spi->dev, "TXRX1 word=%08x, bits=%u\n", word, bits);
-	return bitbang_txrx_be_cpha1(spi, nsecs, 0, word, bits);
+	return bitbang_txrx_be_cpha1(spi, nsecs, 0, 0, word, bits);
 }
 
 static u32 ap83_spi_txrx_mode2(struct spi_device *spi,
 			       unsigned nsecs, u32 word, u8 bits)
 {
 	dev_dbg(&spi->dev, "TXRX2 word=%08x, bits=%u\n", word, bits);
-	return bitbang_txrx_be_cpha0(spi, nsecs, 1, word, bits);
+	return bitbang_txrx_be_cpha0(spi, nsecs, 1, 0, word, bits);
 }
 
 static u32 ap83_spi_txrx_mode3(struct spi_device *spi,
 			       unsigned nsecs, u32 word, u8 bits)
 {
 	dev_dbg(&spi->dev, "TXRX3 word=%08x, bits=%u\n", word, bits);
-	return bitbang_txrx_be_cpha1(spi, nsecs, 1, word, bits);
+	return bitbang_txrx_be_cpha1(spi, nsecs, 1, 0, word, bits);
 }
 
 static int ap83_spi_probe(struct platform_device *pdev)
diff --git a/target/linux/ar71xx/files/drivers/watchdog/ar71xx_wdt.c b/target/linux/ar71xx/files/drivers/watchdog/ar71xx_wdt.c
index b5bc254f8b..5f8104bcdf 100644
--- a/target/linux/ar71xx/files/drivers/watchdog/ar71xx_wdt.c
+++ b/target/linux/ar71xx/files/drivers/watchdog/ar71xx_wdt.c
@@ -146,7 +146,7 @@ static struct watchdog_info ar71xx_wdt_info = {
 	.identity		= "AR71XX watchdog",
 };
 
-static int ar71xx_wdt_ioctl(struct inode *inode, struct file *file,
+static long ar71xx_wdt_ioctl(struct file *file,
 			    unsigned int cmd, unsigned long arg)
 {
 	int t;
@@ -197,7 +197,7 @@ static int ar71xx_wdt_ioctl(struct inode *inode, struct file *file,
 static const struct file_operations ar71xx_wdt_fops = {
 	.owner		= THIS_MODULE,
 	.write		= ar71xx_wdt_write,
-	.ioctl		= ar71xx_wdt_ioctl,
+	.unlocked_ioctl	= ar71xx_wdt_ioctl,
 	.open		= ar71xx_wdt_open,
 	.release	= ar71xx_wdt_release,
 };
diff --git a/target/linux/ar71xx/patches-2.6.32/990-backport.patch b/target/linux/ar71xx/patches-2.6.32/990-backport.patch
new file mode 100644
index 0000000000..2c1c75c67f
--- /dev/null
+++ b/target/linux/ar71xx/patches-2.6.32/990-backport.patch
@@ -0,0 +1,80 @@
+--- a/drivers/net/ag71xx/ag71xx_main.c
++++ b/drivers/net/ag71xx/ag71xx_main.c
+@@ -685,6 +685,7 @@ static netdev_tx_t ag71xx_hard_start_xmi
+ 
+ static int ag71xx_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ {
++	struct mii_ioctl_data *data = (struct mii_ioctl_data *) &ifr->ifr_data;
+ 	struct ag71xx *ag = netdev_priv(dev);
+ 	int ret;
+ 
+@@ -716,7 +717,7 @@ static int ag71xx_do_ioctl(struct net_de
+ 		if (ag->phy_dev == NULL)
+ 			break;
+ 
+-		return phy_mii_ioctl(ag->phy_dev, ifr, cmd);
++		return phy_mii_ioctl(ag->phy_dev, data, cmd);
+ 
+ 	default:
+ 		break;
+--- a/drivers/spi/ap83_spi.c
++++ b/drivers/spi/ap83_spi.c
+@@ -127,34 +127,33 @@ static void ap83_spi_chipselect(struct s
+ 
+ #define EXPAND_BITBANG_TXRX
+ #include <linux/spi/spi_bitbang.h>
+-#include "spi_bitbang_txrx.h"
+ 
+ static u32 ap83_spi_txrx_mode0(struct spi_device *spi,
+ 			       unsigned nsecs, u32 word, u8 bits)
+ {
+ 	dev_dbg(&spi->dev, "TXRX0 word=%08x, bits=%u\n", word, bits);
+-	return bitbang_txrx_be_cpha0(spi, nsecs, 0, 0, word, bits);
++	return bitbang_txrx_be_cpha0(spi, nsecs, 0, word, bits);
+ }
+ 
+ static u32 ap83_spi_txrx_mode1(struct spi_device *spi,
+ 			       unsigned nsecs, u32 word, u8 bits)
+ {
+ 	dev_dbg(&spi->dev, "TXRX1 word=%08x, bits=%u\n", word, bits);
+-	return bitbang_txrx_be_cpha1(spi, nsecs, 0, 0, word, bits);
++	return bitbang_txrx_be_cpha1(spi, nsecs, 0, word, bits);
+ }
+ 
+ static u32 ap83_spi_txrx_mode2(struct spi_device *spi,
+ 			       unsigned nsecs, u32 word, u8 bits)
+ {
+ 	dev_dbg(&spi->dev, "TXRX2 word=%08x, bits=%u\n", word, bits);
+-	return bitbang_txrx_be_cpha0(spi, nsecs, 1, 0, word, bits);
++	return bitbang_txrx_be_cpha0(spi, nsecs, 1, word, bits);
+ }
+ 
+ static u32 ap83_spi_txrx_mode3(struct spi_device *spi,
+ 			       unsigned nsecs, u32 word, u8 bits)
+ {
+ 	dev_dbg(&spi->dev, "TXRX3 word=%08x, bits=%u\n", word, bits);
+-	return bitbang_txrx_be_cpha1(spi, nsecs, 1, 0, word, bits);
++	return bitbang_txrx_be_cpha1(spi, nsecs, 1, word, bits);
+ }
+ 
+ static int ap83_spi_probe(struct platform_device *pdev)
+--- a/drivers/watchdog/ar71xx_wdt.c
++++ b/drivers/watchdog/ar71xx_wdt.c
+@@ -146,7 +146,7 @@ static struct watchdog_info ar71xx_wdt_i
+ 	.identity		= "AR71XX watchdog",
+ };
+ 
+-static long ar71xx_wdt_ioctl(struct file *file,
++static int ar71xx_wdt_ioctl(struct inode *inode, struct file *file,
+ 			    unsigned int cmd, unsigned long arg)
+ {
+ 	int t;
+@@ -197,7 +197,7 @@ static long ar71xx_wdt_ioctl(struct file
+ static const struct file_operations ar71xx_wdt_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.write		= ar71xx_wdt_write,
+-	.unlocked_ioctl	= ar71xx_wdt_ioctl,
++	.ioctl		= ar71xx_wdt_ioctl,
+ 	.open		= ar71xx_wdt_open,
+ 	.release	= ar71xx_wdt_release,
+ };
diff --git a/target/linux/ar71xx/patches-2.6.36/209_watchdog_fix.patch b/target/linux/ar71xx/patches-2.6.36/209_watchdog_fix.patch
deleted file mode 100644
index f0f37f41ea..0000000000
--- a/target/linux/ar71xx/patches-2.6.36/209_watchdog_fix.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/watchdog/ar71xx_wdt.c
-+++ b/drivers/watchdog/ar71xx_wdt.c
-@@ -197,7 +197,7 @@ static int ar71xx_wdt_ioctl(struct inode
- static const struct file_operations ar71xx_wdt_fops = {
- 	.owner		= THIS_MODULE,
- 	.write		= ar71xx_wdt_write,
--	.ioctl		= ar71xx_wdt_ioctl,
-+	.unlocked_ioctl	= ar71xx_wdt_ioctl,
- 	.open		= ar71xx_wdt_open,
- 	.release	= ar71xx_wdt_release,
- };