diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch
new file mode 100644
index 00000000000..40ba73f66bb
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/121-cpe-api-intern-dynamically-allocate-dump-msg.patch
@@ -0,0 +1,99 @@
+--- a/src/drv_mei_cpe_api_intern.c
++++ b/src/drv_mei_cpe_api_intern.c
+@@ -421,7 +421,9 @@ IFX_int32_t MEI_InternalMsgSend(
+    return retVal;
+ }
+ 
+-static IFX_void_t MEI_Internal_DumpMessage(
++#define MEI_Internal_DumpMessage_bufSize  10
++
++static IFX_int32_t MEI_Internal_DumpMessage(
+                               MEI_DYN_CNTRL_T      *pMeiDynCntrl,
+                               const IFX_uint16_t   nMsgId,
+                               const IFX_uint16_t   *pData,
+@@ -435,15 +437,20 @@ static IFX_void_t MEI_Internal_DumpMessa
+    IFX_uint8_t i;
+    const IFX_uint32_t nCommonPayloadSize = 5*nSize/2;
+    const IFX_uint8_t nInfoSize = 35;
+-   const IFX_uint8_t nBufSize = 10;
+    IFX_uint32_t nMsgSize = nCommonPayloadSize + nInfoSize;
+    IFX_uint32_t nCharsWrittenToBuf = 0;
+-   char msg[nMsgSize];
+-   char buf[nBufSize];
++   char *msg;
++   char buf[MEI_Internal_DumpMessage_bufSize];
+ 
+    if((pData == IFX_NULL) || (nSize < 4))
+    {
+-      return ;
++      return 0;
++   }
++
++   msg = kcalloc(nMsgSize, sizeof(*msg), GFP_KERNEL);
++   if (!msg)
++   {
++      return -ENOMEM;
+    }
+ 
+    pMsg16 = (IFX_uint16_t*)(pData+2);
+@@ -464,7 +471,8 @@ static IFX_void_t MEI_Internal_DumpMessa
+       /* 32-bit payload elements */
+       for (i=0; i<((nSize-4)/4); i++)
+       {
+-         nCharsWrittenToBuf = snprintf(buf, nBufSize, " %08X", pMsg32[i]);
++         nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize,
++                                       " %08X", pMsg32[i]);
+          strncat(msg, buf, nMsgSize);
+          nMsgSize -= nCharsWrittenToBuf;
+       }
+@@ -474,7 +482,8 @@ static IFX_void_t MEI_Internal_DumpMessa
+       /* 16-bit payload elements */
+       for (i=0; i<((nSize-4)/2); i++)
+       {
+-         nCharsWrittenToBuf = snprintf(buf, nBufSize, " %04X", pMsg16[i]);
++         nCharsWrittenToBuf = snprintf(buf, MEI_Internal_DumpMessage_bufSize,
++                                       " %04X", pMsg16[i]);
+          strncat(msg, buf, nMsgSize);
+          nMsgSize -= nCharsWrittenToBuf;
+       }
+@@ -482,6 +491,10 @@ static IFX_void_t MEI_Internal_DumpMessa
+    strncat(msg, MEI_DRV_CRLF, nMsgSize);
+ 
+    PRN_DBG_USR_RAW(MEI_MSG_DUMP_API, dbg_level, (msg));
++
++   kfree(msg);
++
++   return 0;
+ }
+ 
+ IFX_int32_t MEI_InternalSendMessage(
+@@ -503,18 +516,25 @@ IFX_int32_t MEI_InternalSendMessage(
+    msg.ack_msg.pPayload = (unsigned char *)pDataAck;
+    msg.ack_msg.paylSize_byte = nLenAck;
+ 
+-   MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId,
++   ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.write_msg.msgId,
+       (IFX_uint16_t *)msg.write_msg.pPayload, msg.write_msg.paylSize_byte,
+       IFX_FALSE, MEI_DRV_PRN_LEVEL_NORMAL);
+ 
++   if (ret < 0)
++   {
++      return ret;
++   }
++
+    ret = MEI_InternalMsgSend(pMeiDynCntrl, &msg);
+ 
+-   if (ret >= 0)
++   if (ret < 0)
+    {
+-      MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId,
++      return ret;
++   }
++
++   ret = MEI_Internal_DumpMessage(pMeiDynCntrl, msg.ack_msg.msgId,
+          (IFX_uint16_t *)msg.ack_msg.pPayload, msg.ack_msg.paylSize_byte,
+          IFX_TRUE, MEI_DRV_PRN_LEVEL_NORMAL);
+-   }
+ 
+    return ret;
+ }
diff --git a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch
new file mode 100644
index 00000000000..63a530b6c51
--- /dev/null
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/122-cp_linux-fix-compilation-warning.patch
@@ -0,0 +1,52 @@
+--- a/src/drv_mei_cpe_linux.c	
++++ b/src/drv_mei_cpe_linux.c
+@@ -1267,7 +1267,9 @@ static long MEI_Ioctl( struct file *filp,
+ MEI_IOCTL_RETURN:
+ 
+    local_args.drv_ioctl.retCode = ret;
+-   copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize);
++   if (copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return (ret < 0) ? -1 : 0;
+ }
+@@ -3571,9 +3573,11 @@ static int MEI_IoctlMeiDbgAccessWr_Wrap(
+    ret =  MEI_IoctlMeiDbgAccessWr( pMeiDynCntrl, pLocalArgument);
+ 
+    /* return arguments - count */
+-   copy_to_user( (void *)&pUserArgument->count,
++   if (copy_to_user( (void *)&pUserArgument->count,
+                  (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++                 sizeof(pUserArgument->count) ))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return ret;
+ }
+@@ -3600,16 +3604,20 @@ static int MEI_IoctlMeiDbgAccessRd_Wrap(
+    if ( pLocalArgument->count )
+    {
+       /* return the buffer */
+-      copy_to_user( pUserBuf,
++      if (copy_to_user( pUserBuf,
+                     pLocalArgument->pData_32,
+-                    pLocalArgument->count * sizeof(IFX_uint32_t) ) ;
++                    pLocalArgument->count * sizeof(IFX_uint32_t) ))
++         PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    }
+ 
+    /* return count argument */
+-   copy_to_user( (void *)&pUserArgument->count,
++   if (copy_to_user( (void *)&pUserArgument->count,
+                  (void *)&pLocalArgument->count,
+-                 sizeof(pUserArgument->count) ) ;
++                 sizeof(pUserArgument->count) ))
++      PRN_ERR_USR_NL( MEI_DRV, MEI_DRV_PRN_LEVEL_ERR,
++             ("MEI_DRV[??] Error ioctl - copy_to_user failed!" MEI_DRV_CRLF));
+ 
+    return ret;
+ }