diff --git a/openwrt/package/iproute2/patches/003-iproute2-htb_overhead.patch b/openwrt/package/iproute2/patches/003-iproute2-htb_overhead.patch
new file mode 100644
index 0000000000..77ab983835
--- /dev/null
+++ b/openwrt/package/iproute2/patches/003-iproute2-htb_overhead.patch
@@ -0,0 +1,96 @@
+--- iproute2-2.6.11-050330.new/tc/q_htb.c	Sun May 12 22:18:27 2002
++++ iproute2-2.6.11-050330.new/tc/q_htb.c	Sat Oct 18 00:05:18 2003
+@@ -34,10 +34,14 @@
+ 		" default  minor id of class to which unclassified packets are sent {0}\n"
+ 		" r2q      DRR quantums are computed as rate in Bps/r2q {10}\n"
+ 		" debug    string of 16 numbers each 0-3 {0}\n\n"
+-		"... class add ... htb rate R1 burst B1 [prio P] [slot S] [pslot PS]\n"
++		"... class add ... htb rate R1 [burst B1] [mpu B] [overhead O]\n"
++		"                      [prio P] [slot S] [pslot PS]\n"
+ 		"                      [ceil R2] [cburst B2] [mtu MTU] [quantum Q]\n"
+ 		" rate     rate allocated to this class (class can still borrow)\n"
+ 		" burst    max bytes burst which can be accumulated during idle period {computed}\n"
++		" mpu      minimum packet size used in rate computations\n"
++		" overhead per-packet size overhead used in rate computations\n"
++
+ 		" ceil     definite upper class rate (no borrows) {rate}\n"
+ 		" cburst   burst but for ceil {computed}\n"
+ 		" mtu      max packet size we create rate map for {1600}\n"
+@@ -102,7 +106,9 @@
+ 	struct tc_htb_opt opt;
+ 	__u32 rtab[256],ctab[256];
+ 	unsigned buffer=0,cbuffer=0;
+-	int cell_log=-1,ccell_log = -1,mtu;
++	int cell_log=-1,ccell_log = -1;
++	unsigned mtu, mpu;
++	unsigned char mpu8 = 0, overhead = 0;
+ 	struct rtattr *tail;
+ 
+ 	memset(&opt, 0, sizeof(opt)); mtu = 1600; /* eth packet len */
+@@ -119,6 +125,16 @@
+ 			if (get_u32(&mtu, *argv, 10)) {
+ 				explain1("mtu"); return -1;
+ 			}
++		} else if (matches(*argv, "mpu") == 0) {
++			NEXT_ARG();
++			if (get_u8(&mpu8, *argv, 10)) {
++				explain1("mpu"); return -1;
++			}
++		} else if (matches(*argv, "overhead") == 0) {
++			NEXT_ARG();
++			if (get_u8(&overhead, *argv, 10)) {
++				explain1("overhead"); return -1;
++			}
+ 		} else if (matches(*argv, "quantum") == 0) {
+ 			NEXT_ARG();
+ 			if (get_u32(&opt.quantum, *argv, 10)) {
+@@ -190,14 +206,18 @@
+ 	if (!buffer) buffer = opt.rate.rate / HZ + mtu;
+ 	if (!cbuffer) cbuffer = opt.ceil.rate / HZ + mtu;
+ 
+-	if ((cell_log = tc_calc_rtable(opt.rate.rate, rtab, cell_log, mtu, 0)) < 0) {
++/* encode overhead and mpu, 8 bits each, into lower 16 bits */
++	mpu = (unsigned)mpu8 | (unsigned)overhead << 8;
++	opt.ceil.mpu = mpu; opt.rate.mpu = mpu;
++
++	if ((cell_log = tc_calc_rtable(opt.rate.rate, rtab, cell_log, mtu, mpu)) < 0) {
+ 		fprintf(stderr, "htb: failed to calculate rate table.\n");
+ 		return -1;
+ 	}
+ 	opt.buffer = tc_calc_xmittime(opt.rate.rate, buffer);
+ 	opt.rate.cell_log = cell_log;
+ 	
+-	if ((ccell_log = tc_calc_rtable(opt.ceil.rate, ctab, cell_log, mtu, 0)) < 0) {
++	if ((ccell_log = tc_calc_rtable(opt.ceil.rate, ctab, cell_log, mtu, mpu)) < 0) {
+ 		fprintf(stderr, "htb: failed to calculate ceil rate table.\n");
+ 		return -1;
+ 	}
+@@ -221,6 +241,7 @@
+ 	double buffer,cbuffer;
+ 	SPRINT_BUF(b1);
+ 	SPRINT_BUF(b2);
++	SPRINT_BUF(b3);
+ 
+ 	if (opt == NULL)
+ 		return 0;
+@@ -243,10 +264,16 @@
+ 	    fprintf(f, "ceil %s ", sprint_rate(hopt->ceil.rate, b1));
+ 	    cbuffer = ((double)hopt->ceil.rate*tc_core_tick2usec(hopt->cbuffer))/1000000;
+ 	    if (show_details) {
+-		fprintf(f, "burst %s/%u mpu %s ", sprint_size(buffer, b1),
+-			1<<hopt->rate.cell_log, sprint_size(hopt->rate.mpu, b2));
+-		fprintf(f, "cburst %s/%u mpu %s ", sprint_size(cbuffer, b1),
+-			1<<hopt->ceil.cell_log, sprint_size(hopt->ceil.mpu, b2));
++		fprintf(f, "burst %s/%u mpu %s overhead %s ",
++			sprint_size(buffer, b1),
++			1<<hopt->rate.cell_log,
++			sprint_size(hopt->rate.mpu&0xFF, b2),
++			sprint_size((hopt->rate.mpu>>8)&0xFF, b3));
++		fprintf(f, "cburst %s/%u mpu %s overhead %s ",
++			sprint_size(cbuffer, b1),
++			1<<hopt->ceil.cell_log,
++			sprint_size(hopt->ceil.mpu&0xFF, b2),
++			sprint_size((hopt->ceil.mpu>>8)&0xFF, b3));
+ 		fprintf(f, "level %d ", (int)hopt->level);
+ 	    } else {
+ 		fprintf(f, "burst %s ", sprint_size(buffer, b1));