diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 1d259e38da..5f05cf8629 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -1,12 +1,12 @@
 # Use the default kernel version if the Makefile doesn't override it
 
 ifeq ($(KERNEL),2.4)
-  LINUX_VERSION?=2.4.37.5
+  LINUX_VERSION?=2.4.37.9
 endif
 LINUX_RELEASE?=1
 
-ifeq ($(LINUX_VERSION),2.4.37.5)
-  LINUX_KERNEL_MD5SUM:=cb221187422acaf6c63a40c646e5e476
+ifeq ($(LINUX_VERSION),2.4.37.9)
+  LINUX_KERNEL_MD5SUM:=b85b8962840c13f17f944e7b1890f8f8
 endif
 ifeq ($(LINUX_VERSION),2.6.25.20)
   LINUX_KERNEL_MD5SUM:=0da698edccf03e2235abc2830a495114
diff --git a/target/linux/brcm-2.4/patches/004-flash.patch b/target/linux/brcm-2.4/patches/004-flash.patch
index 7de8a82eb6..cbcf0da3bb 100644
--- a/target/linux/brcm-2.4/patches/004-flash.patch
+++ b/target/linux/brcm-2.4/patches/004-flash.patch
@@ -1,8 +1,8 @@
---- a/arch/mips/bcm947xx/Makefile	
-+++ b/arch/mips/bcm947xx/Makefile	
-@@ -11,6 +11,7 @@
+--- a/arch/mips/bcm947xx/Makefile
++++ b/arch/mips/bcm947xx/Makefile
+@@ -11,6 +11,7 @@ export-objs     := export.o
  obj-y		:= prom.o setup.o time.o sbmips.o gpio.o
- obj-y		+= nvram.o nvram_linux.o cfe_env.o hndpmu.o
+ obj-y		+= nvram.o cfe_env.o hndpmu.o
  obj-y		+= sbutils.o utils.o bcmsrom.o hndchipc.o
 +obj-y		+= sflash.o
  obj-$(CONFIG_PCI) += sbpci.o pcibios.o
diff --git a/target/linux/generic-2.4/patches/000-linux_mips.patch b/target/linux/generic-2.4/patches/000-linux_mips.patch
index 5eeb65f8b8..0def0d698b 100644
--- a/target/linux/generic-2.4/patches/000-linux_mips.patch
+++ b/target/linux/generic-2.4/patches/000-linux_mips.patch
@@ -12318,7 +12318,7 @@
 +module_exit(au1550spi_exit);
 --- a/drivers/char/Config.in
 +++ b/drivers/char/Config.in
-@@ -320,14 +320,11 @@ fi
+@@ -322,14 +322,11 @@ fi
  if [ "$CONFIG_OBSOLETE" = "y" -a "$CONFIG_ALPHA_BOOK1" = "y" ]; then
     bool 'Tadpole ANA H8 Support (OBSOLETE)'  CONFIG_H8
  fi
@@ -12335,7 +12335,7 @@
  fi
  if [ "$CONFIG_TOSHIBA_RBTX4927" = "y" -o "$CONFIG_TOSHIBA_JMR3927" = "y" ]; then
     tristate 'Dallas DS1742 RTC support' CONFIG_DS1742
-@@ -390,6 +387,11 @@ if [ "$CONFIG_DRM" = "y" ]; then
+@@ -392,6 +389,11 @@ if [ "$CONFIG_DRM" = "y" ]; then
        source drivers/char/drm/Config.in
     fi
  fi
@@ -12347,7 +12347,7 @@
  endmenu
  
  if [ "$CONFIG_HOTPLUG" = "y" -a "$CONFIG_PCMCIA" != "n" ]; then
-@@ -398,6 +400,7 @@ fi
+@@ -400,6 +402,7 @@ fi
  if [ "$CONFIG_SOC_AU1X00" = "y" ]; then
     tristate ' Alchemy Au1x00 GPIO device support' CONFIG_AU1X00_GPIO
     tristate ' Au1000/ADS7846 touchscreen support' CONFIG_TS_AU1X00_ADS7846
@@ -23800,7 +23800,7 @@
  	printk("\n");
 --- a/fs/proc/array.c
 +++ b/fs/proc/array.c
-@@ -368,15 +368,15 @@ int proc_pid_stat(struct task_struct *ta
+@@ -376,15 +376,15 @@ int proc_pid_stat(struct task_struct *ta
  		task->cmin_flt,
  		task->maj_flt,
  		task->cmaj_flt,
@@ -23821,7 +23821,7 @@
  		vsize,
  		mm ? mm->rss : 0, /* you might want to shift this left 3 */
  		task->rlim[RLIMIT_RSS].rlim_cur,
-@@ -615,14 +615,14 @@ int proc_pid_cpu(struct task_struct *tas
+@@ -629,14 +629,14 @@ int proc_pid_cpu(struct task_struct *tas
  
  	len = sprintf(buffer,
  		"cpu  %lu %lu\n",
@@ -27677,23 +27677,23 @@
  include $(TOPDIR)/drivers/bluetooth/Makefile.lib
 --- a/Makefile
 +++ b/Makefile
-@@ -472,10 +472,11 @@ mrproper: clean archmrproper
+@@ -476,10 +476,11 @@ mrproper: clean archmrproper
  	$(MAKE) -C Documentation/DocBook mrproper
  
  distclean: mrproper
 -	rm -f core `find . \( -not -type d \) -and \
 -		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
 -		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
--		-o -name '.*.rej' -o -name '.SUMS' -o -size 0 \) -type f -print` TAGS tags
+-		-o -name '.*.rej' -o -name '.SUMS' -o -size 0 \) -type f -print` TAGS tags cscope*
 +	find . \( -not -type d \) -and \
 +		\( -name core -o -name '*.orig' -o -name '*.rej' \
 +		-o -name '*~' -o -name '*.bak' -o -name '#*#' \
 +		-o -name '.*.rej' -o -name '.SUMS' -o -size 0 \
-+		-o -name TAGS -o -name tags \) -print | env -i xargs rm -f
++		-o -name TAGS -o -name tags -o -name 'cscope*' \) -print | env -i xargs rm -f
  
  backup: mrproper
  	cd .. && tar cf - linux/ | gzip -9 > backup.gz
-@@ -502,7 +503,7 @@ mandocs:
+@@ -506,7 +507,7 @@ mandocs:
  	$(MAKE) -C Documentation/DocBook man
  
  sums:
diff --git a/target/linux/generic-2.4/patches/051-remove_pcmcia_modinst_compat.patch b/target/linux/generic-2.4/patches/051-remove_pcmcia_modinst_compat.patch
index 1b57736776..41d7cbee58 100644
--- a/target/linux/generic-2.4/patches/051-remove_pcmcia_modinst_compat.patch
+++ b/target/linux/generic-2.4/patches/051-remove_pcmcia_modinst_compat.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -431,18 +431,9 @@ else
+@@ -435,18 +435,9 @@ else
  depmod_opts	:= -b $(INSTALL_MOD_PATH) -r
  endif
  .PHONY: _modinst_post
diff --git a/target/linux/generic-2.4/patches/100-wireless-extension.patch b/target/linux/generic-2.4/patches/100-wireless-extension.patch
index d6fc549875..a4eee2d872 100644
--- a/target/linux/generic-2.4/patches/100-wireless-extension.patch
+++ b/target/linux/generic-2.4/patches/100-wireless-extension.patch
@@ -912,7 +912,7 @@
  			err = copy_to_user(iwr->u.data.pointer, extra,
  					   extra_size);
  			if (err)
-@@ -1042,9 +1128,25 @@ void wireless_send_event(struct net_devi
+@@ -1043,9 +1129,25 @@ void wireless_send_event(struct net_devi
   * One of the main advantage of centralising spy support here is that
   * it becomes much easier to improve and extend it without having to touch
   * the drivers. One example is the addition of the Spy-Threshold events.
@@ -939,7 +939,7 @@
  /*------------------------------------------------------------------*/
  /*
   * Standard Wireless Handler : set Spy List
-@@ -1054,16 +1156,26 @@ int iw_handler_set_spy(struct net_device
+@@ -1055,16 +1157,26 @@ int iw_handler_set_spy(struct net_device
  		       union iwreq_data *	wrqu,
  		       char *			extra)
  {
@@ -971,7 +971,7 @@
  	/* Are there are addresses to copy? */
  	if(wrqu->data.length > 0) {
  		int i;
-@@ -1089,13 +1201,14 @@ int iw_handler_set_spy(struct net_device
+@@ -1090,13 +1202,14 @@ int iw_handler_set_spy(struct net_device
  			       spydata->spy_address[i][5]);
  #endif	/* WE_SPY_DEBUG */
  	}
@@ -989,7 +989,7 @@
  }
  
  /*------------------------------------------------------------------*/
-@@ -1107,12 +1220,14 @@ int iw_handler_get_spy(struct net_device
+@@ -1108,12 +1221,14 @@ int iw_handler_get_spy(struct net_device
  		       union iwreq_data *	wrqu,
  		       char *			extra)
  {
@@ -1007,7 +1007,7 @@
  	wrqu->data.length = spydata->spy_number;
  
  	/* Copy addresses. */
-@@ -1129,9 +1244,6 @@ int iw_handler_get_spy(struct net_device
+@@ -1130,9 +1245,6 @@ int iw_handler_get_spy(struct net_device
  	for(i = 0; i < spydata->spy_number; i++)
  		spydata->spy_stat[i].updated = 0;
  	return 0;
@@ -1017,7 +1017,7 @@
  }
  
  /*------------------------------------------------------------------*/
-@@ -1143,11 +1255,13 @@ int iw_handler_set_thrspy(struct net_dev
+@@ -1144,11 +1256,13 @@ int iw_handler_set_thrspy(struct net_dev
  			  union iwreq_data *	wrqu,
  			  char *		extra)
  {
@@ -1034,7 +1034,7 @@
  	/* Just do it */
  	memcpy(&(spydata->spy_thr_low), &(threshold->low),
  	       2 * sizeof(struct iw_quality));
-@@ -1160,9 +1274,6 @@ int iw_handler_set_thrspy(struct net_dev
+@@ -1161,9 +1275,6 @@ int iw_handler_set_thrspy(struct net_dev
  #endif	/* WE_SPY_DEBUG */
  
  	return 0;
@@ -1044,7 +1044,7 @@
  }
  
  /*------------------------------------------------------------------*/
-@@ -1174,22 +1285,20 @@ int iw_handler_get_thrspy(struct net_dev
+@@ -1175,22 +1286,20 @@ int iw_handler_get_thrspy(struct net_dev
  			  union iwreq_data *	wrqu,
  			  char *		extra)
  {
@@ -1072,7 +1072,7 @@
  /*------------------------------------------------------------------*/
  /*
   * Prepare and send a Spy Threshold event
-@@ -1227,7 +1336,6 @@ static void iw_send_thrspy_event(struct 
+@@ -1228,7 +1337,6 @@ static void iw_send_thrspy_event(struct 
  	/* Send event to user space */
  	wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
  }
@@ -1080,7 +1080,7 @@
  
  /* ---------------------------------------------------------------- */
  /*
-@@ -1240,12 +1348,14 @@ void wireless_spy_update(struct net_devi
+@@ -1241,12 +1349,14 @@ void wireless_spy_update(struct net_devi
  			 unsigned char *	address,
  			 struct iw_quality *	wstats)
  {
@@ -1098,7 +1098,7 @@
  #ifdef WE_SPY_DEBUG
  	printk(KERN_DEBUG "wireless_spy_update() :  offset %ld, spydata %p, address %02X:%02X:%02X:%02X:%02X:%02X\n", dev->wireless_handlers->spy_offset, spydata, address[0], address[1], address[2], address[3], address[4], address[5]);
  #endif	/* WE_SPY_DEBUG */
-@@ -1257,7 +1367,7 @@ void wireless_spy_update(struct net_devi
+@@ -1258,7 +1368,7 @@ void wireless_spy_update(struct net_devi
  			       sizeof(struct iw_quality));
  			match = i;
  		}
@@ -1107,7 +1107,7 @@
  	/* Generate an event if we cross the spy threshold.
  	 * To avoid event storms, we have a simple hysteresis : we generate
  	 * event only when we go under the low threshold or above the
-@@ -1277,6 +1387,4 @@ void wireless_spy_update(struct net_devi
+@@ -1278,6 +1388,4 @@ void wireless_spy_update(struct net_devi
  			}
  		}
  	}
diff --git a/target/linux/generic-2.4/patches/108-optional_aout_support.patch b/target/linux/generic-2.4/patches/108-optional_aout_support.patch
index ff8c8cf30e..2162b88181 100644
--- a/target/linux/generic-2.4/patches/108-optional_aout_support.patch
+++ b/target/linux/generic-2.4/patches/108-optional_aout_support.patch
@@ -149,7 +149,7 @@
  CONFIG_ACPI_EFI=y
 --- a/arch/m68k/config.in
 +++ b/arch/m68k/config.in
-@@ -99,6 +99,9 @@ if [ "$CONFIG_PROC_FS" = "y" ]; then
+@@ -100,6 +100,9 @@ if [ "$CONFIG_PROC_FS" = "y" ]; then
  fi
  tristate 'Kernel support for a.out binaries' CONFIG_BINFMT_AOUT
  bool 'Kernel support for ELF binaries' CONFIG_BINFMT_ELF
diff --git a/target/linux/generic-2.4/patches/209-build_fixes.patch b/target/linux/generic-2.4/patches/209-build_fixes.patch
index 5e76fd92b6..720f0f3e54 100644
--- a/target/linux/generic-2.4/patches/209-build_fixes.patch
+++ b/target/linux/generic-2.4/patches/209-build_fixes.patch
@@ -9,7 +9,7 @@
  	  (echo KERNELRELEASE \"$(KERNELRELEASE)\" exceeds $(uts_len) characters >&2; false)
  	@echo \#define UTS_RELEASE \"$(KERNELRELEASE)\" > .ver
  	@echo \#define LINUX_VERSION_CODE `expr $(VERSION) \\* 65536 + $(PATCHLEVEL) \\* 256 + $(SUBLEVEL)` >> .ver
-@@ -503,7 +503,7 @@ dep-files: scripts/mkdep archdep include
+@@ -507,7 +507,7 @@ dep-files: scripts/mkdep archdep include
  ifdef CONFIG_MODVERSIONS
  	$(MAKE) update-modverfile
  endif
diff --git a/target/linux/generic-2.4/patches/628-netfilter_raw.patch b/target/linux/generic-2.4/patches/628-netfilter_raw.patch
index 419fb01e58..de54a352d8 100644
--- a/target/linux/generic-2.4/patches/628-netfilter_raw.patch
+++ b/target/linux/generic-2.4/patches/628-netfilter_raw.patch
@@ -1,6 +1,6 @@
 --- a/Documentation/Configure.help
 +++ b/Documentation/Configure.help
-@@ -3057,6 +3057,34 @@
+@@ -3057,6 +3057,34 @@ CONFIG_IP_NF_FILTER
    If you want to compile it as a module, say M here and read
    <file:Documentation/modules.txt>.  If unsure, say `N'.
  
@@ -37,7 +37,7 @@
    The REJECT target allows a filtering rule to specify that an ICMP
 --- a/include/linux/netfilter_ipv4/ip_conntrack.h
 +++ b/include/linux/netfilter_ipv4/ip_conntrack.h
-@@ -286,6 +286,9 @@
+@@ -286,6 +286,9 @@ extern void ip_ct_refresh_acct(struct ip
  /* Call me when a conntrack is destroyed. */
  extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
  
@@ -81,7 +81,7 @@
  	NF_IP_PRI_NAT_DST = -100,
 --- a/net/ipv4/netfilter/Config.in
 +++ b/net/ipv4/netfilter/Config.in
-@@ -153,6 +153,15 @@
+@@ -153,6 +153,15 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ]; 
    dep_tristate '  TTL target support' CONFIG_IP_NF_TARGET_TTL $CONFIG_IP_NF_IPTABLES
    dep_tristate '  ULOG target support' CONFIG_IP_NF_TARGET_ULOG $CONFIG_IP_NF_IPTABLES
    dep_tristate '  TCPMSS target support' CONFIG_IP_NF_TARGET_TCPMSS $CONFIG_IP_NF_IPTABLES
@@ -99,7 +99,7 @@
  tristate 'ARP tables support' CONFIG_IP_NF_ARPTABLES
 --- a/net/ipv4/netfilter/ip_conntrack_core.c
 +++ b/net/ipv4/netfilter/ip_conntrack_core.c
-@@ -64,6 +64,7 @@
+@@ -64,6 +64,7 @@ int ip_conntrack_max = 0;
  static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
  struct list_head *ip_conntrack_hash;
  static kmem_cache_t *ip_conntrack_cachep;
@@ -107,7 +107,7 @@
  static LIST_HEAD(unconfirmed);
  
  extern struct ip_conntrack_protocol ip_conntrack_generic_protocol;
-@@ -834,6 +835,15 @@
+@@ -834,6 +835,15 @@ unsigned int ip_conntrack_in(unsigned in
  	int set_reply;
  	int ret;
  
@@ -123,7 +123,7 @@
  	/* FIXME: Do this right please. --RR */
  	(*pskb)->nfcache |= NFC_UNKNOWN;
  
-@@ -1489,6 +1499,18 @@
+@@ -1489,6 +1499,18 @@ int __init ip_conntrack_init(void)
  
  	/* For use by ipt_REJECT */
  	ip_ct_attach = ip_conntrack_attach;
@@ -144,7 +144,7 @@
  err_free_hash:
 --- a/net/ipv4/netfilter/ip_conntrack_standalone.c
 +++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
-@@ -218,6 +218,29 @@
+@@ -218,6 +218,29 @@ static unsigned int ip_confirm(unsigned 
  	return ip_conntrack_confirm(*pskb);
  }
  
@@ -174,7 +174,7 @@
  static unsigned int ip_refrag(unsigned int hooknum,
  			      struct sk_buff **pskb,
  			      const struct net_device *in,
-@@ -259,9 +282,15 @@
+@@ -259,9 +282,15 @@ static unsigned int ip_conntrack_local(u
  
  /* Connection tracking may drop packets, but never alters them, so
     make it the first hook. */
@@ -190,7 +190,7 @@
  static struct nf_hook_ops ip_conntrack_local_out_ops
  = { { NULL, NULL }, ip_conntrack_local, PF_INET, NF_IP_LOCAL_OUT,
  	NF_IP_PRI_CONNTRACK };
-@@ -382,10 +411,20 @@
+@@ -382,10 +411,20 @@ static int init_or_cleanup(int init)
  	if (!proc) goto cleanup_init;
  	proc->owner = THIS_MODULE;
  
@@ -212,7 +212,7 @@
  	}
  	ret = nf_register_hook(&ip_conntrack_local_out_ops);
  	if (ret < 0) {
-@@ -423,6 +462,10 @@
+@@ -423,6 +462,10 @@ static int init_or_cleanup(int init)
  	nf_unregister_hook(&ip_conntrack_local_out_ops);
   cleanup_inops:
  	nf_unregister_hook(&ip_conntrack_in_ops);
@@ -223,7 +223,7 @@
   cleanup_proc:
  	proc_net_remove("ip_conntrack");
   cleanup_init:
-@@ -512,5 +555,6 @@
+@@ -512,5 +555,6 @@ EXPORT_SYMBOL(ip_conntrack_htable_size);
  EXPORT_SYMBOL(ip_conntrack_expect_list);
  EXPORT_SYMBOL(ip_conntrack_lock);
  EXPORT_SYMBOL(ip_conntrack_hash);
@@ -232,7 +232,7 @@
  EXPORT_SYMBOL_GPL(ip_conntrack_put);
 --- a/net/ipv4/netfilter/ip_nat_core.c
 +++ b/net/ipv4/netfilter/ip_nat_core.c
-@@ -1023,6 +1023,10 @@
+@@ -1023,6 +1023,10 @@ int __init ip_nat_init(void)
  	/* FIXME: Man, this is a hack.  <SIGH> */
  	IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
  	ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
@@ -397,7 +397,7 @@
 +MODULE_LICENSE("GPL");
 --- a/net/ipv4/netfilter/ipt_conntrack.c
 +++ b/net/ipv4/netfilter/ipt_conntrack.c
-@@ -27,11 +27,13 @@
+@@ -27,11 +27,13 @@ match(const struct sk_buff *skb,
  
  #define FWINV(bool,invflg) ((bool) ^ !!(sinfo->invflags & invflg))
  
@@ -496,7 +496,7 @@
 +MODULE_LICENSE("GPL");
 --- a/net/ipv4/netfilter/ipt_state.c
 +++ b/net/ipv4/netfilter/ipt_state.c
-@@ -21,7 +21,9 @@
+@@ -21,7 +21,9 @@ match(const struct sk_buff *skb,
  	enum ip_conntrack_info ctinfo;
  	unsigned int statebit;
  
@@ -509,7 +509,7 @@
  		statebit = IPT_STATE_BIT(ctinfo);
 --- a/net/ipv4/netfilter/Makefile
 +++ b/net/ipv4/netfilter/Makefile
-@@ -77,6 +77,7 @@
+@@ -77,6 +77,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_table
  obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
  obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
  obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
@@ -517,7 +517,7 @@
  
  # matches
  obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
-@@ -131,6 +132,7 @@
+@@ -131,6 +132,7 @@ obj-$(CONFIG_IP_NF_TARGET_CONNMARK) += i
  obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
  obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
  obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
@@ -527,7 +527,7 @@
  obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
 --- a/net/ipv6/netfilter/Config.in
 +++ b/net/ipv6/netfilter/Config.in
-@@ -79,6 +79,10 @@
+@@ -79,6 +79,10 @@ if [ "$CONFIG_IP6_NF_IPTABLES" != "n" ];
      dep_tristate '    IMQ target support' CONFIG_IP6_NF_TARGET_IMQ $CONFIG_IP6_NF_MANGLE
    fi
    #dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
@@ -697,7 +697,7 @@
 +MODULE_LICENSE("GPL");
 --- a/net/ipv6/netfilter/Makefile
 +++ b/net/ipv6/netfilter/Makefile
-@@ -32,6 +32,7 @@
+@@ -32,6 +32,7 @@ obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t
  obj-$(CONFIG_IP6_NF_TARGET_IMQ) += ip6t_IMQ.o
  obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
  obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o