diff --git a/patches/lede/0092-ar71xx-lzma-loader-move-padding-workaround-to-gzip-step.patch b/patches/lede/0092-ar71xx-lzma-loader-move-padding-workaround-to-gzip-step.patch
new file mode 100644
index 0000000000000000000000000000000000000000..870f7427a5008a6c89d698740babe68c393592af
--- /dev/null
+++ b/patches/lede/0092-ar71xx-lzma-loader-move-padding-workaround-to-gzip-step.patch
@@ -0,0 +1,54 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 6 Jun 2018 20:51:05 +0200
+Subject: ar71xx: lzma-loader: move padding workaround to gzip step
+
+Some devices (TP-Link TL-WR1043ND v1) don't boot reliably when the
+uncompressed loader is too small. This was workarounded in the loader by
+adding 512KB of padding to the .data section of the loader binary.
+
+This approach had two issues:
+
+- The padding was only working when .data was non-empty (otherwise the
+ section would become NOBITS, omitting it in the binary). .data was only
+ empty when no CMDLINE was set, leading to further workarounds like
+ fe594bf90d09 ("ath79: fix loader-okli, lzma-loader"), and this
+ workaround was only effective because a missing "const" led to the kernel
+ argv being stored in .data instead of .rodata
+- The padding was not only added to the compressed .gz loader, but also
+ uncompressed .bin and .elf loaders. The prevented embedding the kernel
+ cmdline in the loader for non-gz loader types.
+
+To fix both issues, move the creation of the padding from the linker script
+to the gzip step.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/lzma-loader/Makefile b/target/linux/ar71xx/image/lzma-loader/Makefile
+index 9b81e87306f235d1e7284401828240b9b9787011..738093a958013624abb8f84a3874e1c795da349d 100644
+--- a/target/linux/ar71xx/image/lzma-loader/Makefile
++++ b/target/linux/ar71xx/image/lzma-loader/Makefile
+@@ -47,7 +47,11 @@ loader-compile: $(PKG_BUILD_DIR)/.prepared
+ clean all
+
+ loader.gz: $(PKG_BUILD_DIR)/loader.bin
+- gzip -nc9 $< > $(LOADER_GZ)
++ # Workaround for buggy bootloaders: Some devices
++ # (TP-Link TL-WR1043ND v1) don't work correctly when
++ # the uncompressed loader is too small (probably a cache
++ # invalidation issue)
++ dd if=$< bs=512K conv=sync | gzip -nc9 > $(LOADER_GZ)
+
+ loader.elf: $(PKG_BUILD_DIR)/loader.elf
+ $(CP) $< $(LOADER_ELF)
+diff --git a/target/linux/ar71xx/image/lzma-loader/src/loader.lds b/target/linux/ar71xx/image/lzma-loader/src/loader.lds
+index 80cc7ca3ecf53a747fc139560b89c233f4343293..01ff85236147dc62bae480b191a44005171b1561 100644
+--- a/target/linux/ar71xx/image/lzma-loader/src/loader.lds
++++ b/target/linux/ar71xx/image/lzma-loader/src/loader.lds
+@@ -13,7 +13,6 @@ SECTIONS {
+ .data : {
+ *(.data)
+ *(.data.*)
+- . = . + 524288; /* workaround for buggy bootloaders */
+ }
+
+ . = ALIGN(32);
diff --git a/patches/lede/0093-ar71xx-lzma-loader-set-page-size-to-4KB.patch b/patches/lede/0093-ar71xx-lzma-loader-set-page-size-to-4KB.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f9fdae6aa3356429c4d44187bf46626d25b0bb89
--- /dev/null
+++ b/patches/lede/0093-ar71xx-lzma-loader-set-page-size-to-4KB.patch
@@ -0,0 +1,23 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 6 Jun 2018 00:27:42 +0200
+Subject: ar71xx: lzma-loader: set page size to 4KB
+
+The text section in the ELF loader is aligned to the maximum page size,
+which defaults to 64KB. Reduce it to the actual page size to avoid wasting
+flash space for this alignment.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/lzma-loader/src/Makefile b/target/linux/ar71xx/image/lzma-loader/src/Makefile
+index 5f10bdb8f1499f24f00a8bf4d53f370fef88bd1e..fadb7e6206070c07aab3e8b323324976c6998eea 100644
+--- a/target/linux/ar71xx/image/lzma-loader/src/Makefile
++++ b/target/linux/ar71xx/image/lzma-loader/src/Makefile
+@@ -95,7 +95,7 @@ loader2.o: loader.bin
+ $(LD) -r -b binary --oformat $(O_FORMAT) -o $@ $<
+
+ loader.elf: loader2.o
+- $(LD) -e startup -T loader2.lds -Ttext $(LOADADDR) -o $@ $<
++ $(LD) -z max-page-size=0x1000 -e startup -T loader2.lds -Ttext $(LOADADDR) -o $@ $<
+
+ mrproper: clean
+
diff --git a/patches/lede/0094-ar71xx-lzma-loader-constify-kernel-argv-array.patch b/patches/lede/0094-ar71xx-lzma-loader-constify-kernel-argv-array.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6dfe3ca26bba4d85ee37e4d7477003217bc6ff0c
--- /dev/null
+++ b/patches/lede/0094-ar71xx-lzma-loader-constify-kernel-argv-array.patch
@@ -0,0 +1,22 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 6 Jun 2018 00:30:57 +0200
+Subject: ar71xx: lzma-loader: constify kernel argv array
+
+By making the kernel argv array const, the .data section can always be
+omitted from the laoder binary.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/lzma-loader/src/loader.c b/target/linux/ar71xx/image/lzma-loader/src/loader.c
+index cc73eb1721cbfbf2ad1bb94e8e6d3ab006983c5d..794c4b6285a7fa0423c22d172828415e6f2be93b 100644
+--- a/target/linux/ar71xx/image/lzma-loader/src/loader.c
++++ b/target/linux/ar71xx/image/lzma-loader/src/loader.c
+@@ -75,7 +75,7 @@ static unsigned long kernel_la;
+ #ifdef CONFIG_KERNEL_CMDLINE
+ #define kernel_argc 2
+ static const char kernel_cmdline[] = CONFIG_KERNEL_CMDLINE;
+-static const char *kernel_argv[] = {
++static const char *const kernel_argv[] = {
+ NULL,
+ kernel_cmdline,
+ NULL,
diff --git a/patches/lede/0095-ar71xx-make-loader-okli-build-step-more-generic.patch b/patches/lede/0095-ar71xx-make-loader-okli-build-step-more-generic.patch
new file mode 100644
index 0000000000000000000000000000000000000000..737d21bc435a07791da929f9aac980c6c4ebb5af
--- /dev/null
+++ b/patches/lede/0095-ar71xx-make-loader-okli-build-step-more-generic.patch
@@ -0,0 +1,36 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 6 Jun 2018 00:34:25 +0200
+Subject: ar71xx: make loader-okli build step more generic
+
+Add support for different loader types.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/Makefile b/target/linux/ar71xx/image/Makefile
+index 8eac5fc997cab0203718fb0558e6f5aaaeec9c38..de27f5d7c5ce6dbd31305c139afc128edaed15ee 100644
+--- a/target/linux/ar71xx/image/Makefile
++++ b/target/linux/ar71xx/image/Makefile
+@@ -73,8 +73,9 @@ define Build/loader-kernel-cmdline
+ $(call Build/loader-common,LOADER_DATA="$@" KERNEL_CMDLINE="$(CMDLINE)")
+ endef
+
++# Arguments: <output name> <kernel offset>
+ define Build/loader-okli
+- dd if=$(KDIR)/loader-$(1).gz bs=7680 conv=sync of="$@.new"
++ dd if=$(KDIR)/loader-$(word 1,$(1)).$(LOADER_TYPE) bs=$(word 2,$(1)) conv=sync of="$@.new"
+ cat "$@" >> "$@.new"
+ mv "$@.new" "$@"
+ endef
+diff --git a/target/linux/ar71xx/image/tp-link.mk b/target/linux/ar71xx/image/tp-link.mk
+index 1e40d943ac2aa43aea670fd86268708aea39a46c..18e2c73737f477f4d00020893878cbdfb81a735b 100644
+--- a/target/linux/ar71xx/image/tp-link.mk
++++ b/target/linux/ar71xx/image/tp-link.mk
+@@ -69,7 +69,7 @@ $(Device/tplink)
+ LOADER_FLASH_OFFS := 0x22000
+ COMPILE := loader-$(1).gz
+ COMPILE/loader-$(1).gz := loader-okli-compile
+- KERNEL := copy-file $(KDIR)/vmlinux.bin.lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1)
++ KERNEL := copy-file $(KDIR)/vmlinux.bin.lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 7680
+ KERNEL_INITRAMFS := copy-file $(KDIR)/vmlinux-initramfs.bin.lzma | loader-kernel-cmdline | mktplinkfw-combined
+ endef
+
diff --git a/patches/lede/0096-ar71xx-switch-CPE-WBS-210-510-to-okli-loader.patch b/patches/lede/0096-ar71xx-switch-CPE-WBS-210-510-to-okli-loader.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f77a2cfab4b944a7df8417d6e64bfbfe2e0dad3a
--- /dev/null
+++ b/patches/lede/0096-ar71xx-switch-CPE-WBS-210-510-to-okli-loader.patch
@@ -0,0 +1,39 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Wed, 6 Jun 2018 00:35:17 +0200
+Subject: ar71xx: switch CPE/WBS 210/510 to okli-loader
+
+We recently increased the kernel partition size of the CPE/WBS 210/510.
+This works fine for new installations of the factory image, but on
+sysupgrades, the partition table read by the bootloader is not adjusted.
+This limits the maximum size of the kernel loaded by the bootloader to the
+old partition size.
+
+While adjusting the partition table would be a cleanest solution, such a
+migration would have to happen before an upgrade to a new version with a
+newer kernel. This is error-prone and would require a two-step upgrade, as
+we mark the partition table partition read-only.
+
+Instead, switch from the lzma-loader with embedded kernel to the
+okli-loader, so only the tiny lzma-loader is loaded by the bootloader as
+"kernel", and the lzma-loader will then load the rest of the kernel by
+itself.
+
+Fixes: e39847ea2f70 ("ar71xx: increase kernel partition size for CPE/WBS 210/510")
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ar71xx/image/tp-link.mk b/target/linux/ar71xx/image/tp-link.mk
+index 18e2c73737f477f4d00020893878cbdfb81a735b..709b1558a5f8487c50e922ec4d27b643f080cbcc 100644
+--- a/target/linux/ar71xx/image/tp-link.mk
++++ b/target/linux/ar71xx/image/tp-link.mk
+@@ -173,7 +173,10 @@ define Device/cpe510-520
+ TPLINK_BOARD_NAME := CPE510
+ DEVICE_PROFILE := CPE510
+ LOADER_TYPE := elf
+- KERNEL := kernel-bin | patch-cmdline | lzma | loader-kernel
++ LOADER_FLASH_OFFS := 0x43000
++ COMPILE := loader-$(1).elf
++ COMPILE/loader-$(1).elf := loader-okli-compile
++ KERNEL := kernel-bin | lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 12288
+ IMAGES := sysupgrade.bin factory.bin
+ IMAGE/sysupgrade.bin := append-rootfs | tplink-safeloader sysupgrade
+ IMAGE/factory.bin := append-rootfs | tplink-safeloader factory