diff --git a/target/linux/ipq806x/Makefile b/target/linux/ipq806x/Makefile
index 1512b30..f97db74 100644
--- a/target/linux/ipq806x/Makefile
+++ b/target/linux/ipq806x/Makefile
@@ -11,7 +11,7 @@ MAINTAINER:=John Crispin <blogic@openwrt.org>
 
 KERNEL_PATCHVER:=3.18
 
-KERNELNAME:=Image dtbs
+KERNELNAME:=zImage Image dtbs
 
 include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += \
diff --git a/target/linux/ipq806x/config-3.18 b/target/linux/ipq806x/config-3.18
index 8de4cb4..219e2c7 100644
--- a/target/linux/ipq806x/config-3.18
+++ b/target/linux/ipq806x/config-3.18
@@ -33,8 +33,12 @@ CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 CONFIG_ARM=y
 CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+# CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND is not set
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
 CONFIG_ARM_CPU_SUSPEND=y
 CONFIG_ARM_GIC=y
 CONFIG_ARM_HAS_SG_CHAIN=y
@@ -48,7 +52,7 @@ CONFIG_ARM_THUMB=y
 CONFIG_ARM_UNWIND=y
 CONFIG_ARM_VIRT_EXT=y
 CONFIG_AT803X_PHY=y
-CONFIG_AUTO_ZRELADDR=y
+CONFIG_ATAGS=y
 # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
 CONFIG_BOUNCE=y
@@ -92,6 +96,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 CONFIG_DEBUG_GPIO=y
 CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
 CONFIG_DEBUG_PREEMPT=y
+# CONFIG_DEBUG_QCOM_UARTDM is not set
 # CONFIG_DEBUG_UART_8250 is not set
 # CONFIG_DEBUG_UART_PL01X is not set
 # CONFIG_DEBUG_USER is not set
diff --git a/target/linux/ipq806x/config-4.0 b/target/linux/ipq806x/config-4.0
index c7bbcd9..7136424 100644
--- a/target/linux/ipq806x/config-4.0
+++ b/target/linux/ipq806x/config-4.0
@@ -34,8 +34,12 @@ CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 CONFIG_ARM=y
 CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+# CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND is not set
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
 CONFIG_ARM_CPU_SUSPEND=y
 CONFIG_ARM_GIC=y
 CONFIG_ARM_HAS_SG_CHAIN=y
@@ -50,8 +54,7 @@ CONFIG_ARM_THUMB=y
 CONFIG_ARM_UNWIND=y
 CONFIG_ARM_VIRT_EXT=y
 CONFIG_AT803X_PHY=y
-CONFIG_AUTO_ZRELADDR=y
-# CONFIG_BATTERY_GAUGE_LTC2941 is not set
+CONFIG_ATAGS=y
 # CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
 CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
 CONFIG_BOUNCE=y
@@ -348,7 +351,6 @@ CONFIG_SWCONFIG=y
 CONFIG_SWIOTLB=y
 CONFIG_SWP_EMULATE=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
-# CONFIG_TEGRA_AHB is not set
 CONFIG_THERMAL=y
 # CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
 CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
diff --git a/target/linux/ipq806x/patches-4.0/300-arch-arm-force-ZRELADDR-on-arch-qcom.patch b/target/linux/ipq806x/patches-4.0/300-arch-arm-force-ZRELADDR-on-arch-qcom.patch
new file mode 100644
index 0000000..82170cd
--- /dev/null
+++ b/target/linux/ipq806x/patches-4.0/300-arch-arm-force-ZRELADDR-on-arch-qcom.patch
@@ -0,0 +1,72 @@
+From b12e230f09d4481424e6a5d7e2ae566b6954e83f Mon Sep 17 00:00:00 2001
+From: Mathieu Olivari <mathieu@codeaurora.org>
+Date: Wed, 29 Apr 2015 15:21:46 -0700
+Subject: [PATCH] HACK: arch: arm: force ZRELADDR on arch-qcom
+
+ARCH_QCOM is using the ARCH_MULTIPLATFORM option, as now recommended
+on most ARM architectures. This automatically calculate ZRELADDR by
+masking PHYS_OFFSET with 0xf8000000.
+
+However, on IPQ806x, the first ~20MB of RAM is reserved for the hardware
+network accelerators, and the bootloader removes this section from the
+layout passed from the ATAGS (when used).
+
+For newer bootloader, when DT is used, this is not a problem, we just
+reserve this memory in the device tree. But if the bootloader doesn't
+have DT support, then ATAGS have to be used. In this case, the ARM
+decompressor will position the kernel in this low mem, which will not be
+in the RAM section mapped by the bootloader, which means the kernel will
+freeze in the middle of the boot process trying to map the memory.
+
+As a work around, this patch allows disabling AUTO_ZRELADDR when
+ARCH_QCOM is selected. It makes the zImage usage possible on bootloaders
+which don't support device-tree, which is the case on certain early
+IPQ806x based designs.
+
+Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
+---
+ arch/arm/Kconfig                 | 2 +-
+ arch/arm/Makefile                | 2 ++
+ arch/arm/mach-qcom/Makefile.boot | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm/mach-qcom/Makefile.boot
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 89c4b5c..4583ea5 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -311,7 +311,7 @@ config ARCH_MULTIPLATFORM
+ 	select ARCH_WANT_OPTIONAL_GPIOLIB
+ 	select ARM_HAS_SG_CHAIN
+ 	select ARM_PATCH_PHYS_VIRT
+-	select AUTO_ZRELADDR
++	select AUTO_ZRELADDR if !ARCH_QCOM
+ 	select CLKSRC_OF
+ 	select COMMON_CLK
+ 	select GENERIC_CLOCKEVENTS
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index 7453352..5d6f8ac 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -240,9 +240,11 @@ MACHINE  := arch/arm/mach-$(word 1,$(machine-y))/
+ else
+ MACHINE  :=
+ endif
++ifeq ($(CONFIG_ARCH_QCOM),)
+ ifeq ($(CONFIG_ARCH_MULTIPLATFORM),y)
+ MACHINE  :=
+ endif
++endif
+ 
+ machdirs := $(patsubst %,arch/arm/mach-%/,$(machine-y))
+ platdirs := $(patsubst %,arch/arm/plat-%/,$(sort $(plat-y)))
+diff --git a/arch/arm/mach-qcom/Makefile.boot b/arch/arm/mach-qcom/Makefile.boot
+new file mode 100644
+index 0000000..67a6d5a
+--- /dev/null
++++ b/arch/arm/mach-qcom/Makefile.boot
+@@ -0,0 +1 @@
++zreladdr-y+= 0x42208000
+-- 
+1.9.1
+
