branch Attitude Adjustment

git-svn-id: svn://svn.openwrt.org/openwrt/branches/attitude_adjustment@33625 3c298f89-4303-0410-b956-a3cf2f4a3e73

11 files changed, 1681 insertions, 0 deletions

diff --git a/target/linux/brcm63xx/image/Makefile b/target/linux/brcm63xx/image/Makefile
new file mode 100644
index 000000000..af5a68c82
--- /dev/null
+++ b/target/linux/brcm63xx/image/Makefile
@@ -0,0 +1,259 @@
+# 
+# Copyright (C) 2006-2011 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+LOADADDR = 0x80010000		# RAM start + 16M 
+KERNEL_ENTRY = $(LOADADDR)	# Newer kernels add a jmp to the kernel_entry at the start of the binary
+RAMSIZE = 0x01000000		# 64MB
+
+LOADER_MAKEOPTS= \
+		KDIR=$(KDIR) \
+		LOADADDR=$(LOADADDR) \
+		KERNEL_ENTRY=$(KERNEL_ENTRY) \
+		RAMSIZE=$(RAMSIZE)
+
+define trxalign/jffs2-128k
+-a 0x20000
+endef
+define trxalign/jffs2-64k
+-a 0x10000
+endef
+define trxalign/squashfs
+-a 1024
+endef
+
+define Image/LimitName16
+$(shell expr substr "$(1)" 1 16)
+endef
+
+define Image/Build/CFE
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(4)-$(1)-cfe.bin \
+		--boardid $(2) --chipid $(3) --entry $(KERNEL_ENTRY) \
+		--load-addr $(LOADADDR) --rsa-signature "$(5)" \
+		--info1 "-$(call Image/LimitName16,$(4))" --info2 $(1) \
+		$(6) $(7) $(8) $(9)
+endef
+
+define Image/Build/CFEFIXUP
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(5)-$(1)-cfe.bin \
+		--boardid $(2) --chipid $(4) --entry $(KERNEL_ENTRY) \
+		--load-addr $(LOADADDR) --rsa-signature "$(6)" \
+		--info1 "+$(call Image/LimitName16,$(3))" --info2 $(1) \
+		$(7) $(8) $(9) $(10)
+endef
+
+define Image/Build/CFEHW553
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(5)-$(1)-cfe.bin \
+		--boardid $(2) --chipid $(3) --entry $(LOADADDR) \
+		--load-addr $(LOADADDR) --tag-version 7 \
+		--block-size 0x20000 --image-offset $(4)
+endef
+
+define Image/Build/CFEAGPF
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(5)-$(1)-cfe.bin \
+		--boardid $(2) --chipid $(3) --entry $(LOADADDR) \
+		--load-addr $(LOADADDR) --tag-version 8 \
+		--signature2 IMAGE --block-size 0x20000 \
+		--image-offset $(4) --info1 "-$(call Image/LimitName16,$(5))" --info2 $(1)
+endef
+
+define Image/Build/RG100A
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(5)-$(1)-cfe.bin \
+		--boardid $(2) --chipid $(3) --entry $(LOADADDR) \
+		--load-addr $(LOADADDR) --block-size 0x20000 \
+		--image-offset $(4) --info1 "-$(call Image/LimitName16,$(5))" --info2 $(1)
+endef
+
+define Image/Build/RedBoot
+	cp $(KDIR)/vmlinux.elf $(BIN_DIR)/openwrt-$(1)-vmlinux.elf
+	gzip -9 -c $(KDIR)/vmlinux > $(KDIR)/vmlinux.bin.gz
+	$(STAGING_DIR_HOST)/bin/lzma e $(KDIR)/vmlinux $(KDIR)/vmlinux.bin.l7
+	dd if=$(KDIR)/vmlinux.bin.l7 of=$(BIN_DIR)/openwrt-$(1)-vmlinux.lzma bs=65536 conv=sync
+	dd if=$(KDIR)/vmlinux.bin.gz of=$(BIN_DIR)/openwrt-$(1)-vmlinux.gz bs=65536 conv=sync
+endef
+
+define Image/Build/SPW303V
+	# Generate the tagged image
+	$(STAGING_DIR_HOST)/bin/imagetag -i $(KDIR)/vmlinux.lzma.cfe -f $(KDIR)/root.$(1) \
+		--output $(BIN_DIR)/openwrt-$(4)-$(1)-cfe.bin.tmp \
+		--boardid $(2) --chipid $(3) --entry $(KERNEL_ENTRY) \
+		--load-addr $(LOADADDR) --rsa-signature "$(5)" \
+		--pad 4 $(6) $(7) $(8) $(9)
+	# Fix up header
+	$(STAGING_DIR_HOST)/bin/spw303v -i $(BIN_DIR)/openwrt-$(4)-$(1)-cfe.bin.tmp \
+		-o $(BIN_DIR)/openwrt-$(4)-$(1)-cfe-sysupgrade.bin
+	$(STAGING_DIR_HOST)/bin/xorimage -i $(BIN_DIR)/openwrt-$(4)-$(1)-cfe-sysupgrade.bin \
+		-o $(BIN_DIR)/openwrt-$(4)-$(1)-cfe-factory.bin
+	rm -f $(BIN_DIR)/openwrt-$(4)-$(1)-cfe.bin.tmp
+endef
+
+define Image/Build/CFEOLD
+	$(TOPDIR)/scripts/brcmImage.pl -t -p	\
+		-b $(2) -c $(3)			\
+		-k $(KDIR)/vmlinux.lzma.cfe	\
+		-r $(KDIR)/root.$(1)		\
+		-o $(BIN_DIR)/openwrt-$(2)-$(1)-cfe.bin
+endef
+
+define Build/Clean
+	$(MAKE) -C lzma-loader clean
+endef
+
+define Image/Prepare
+	# Standard LZMA kernel
+	cat $(KDIR)/vmlinux | $(STAGING_DIR_HOST)/bin/lzma e -si -so -eos -lc1 -lp2 -pb2 > $(KDIR)/vmlinux.lzma
+
+	# CFE is a LZMA nazi! It took me hours to find out the parameters!
+	# Also I think lzma has a bug cause it generates different output depending on
+	# if you use stdin / stdout or not. Use files instead of stdio here, cause
+	# otherwise CFE will complain and not boot the image.
+	$(STAGING_DIR_HOST)/bin/lzma e -d22 -fb64 -a1 $(KDIR)/vmlinux $(KDIR)/vmlinux.lzma.tmp
+
+	# Strip out the length, CFE doesn't like this
+	dd if=$(KDIR)/vmlinux.lzma.tmp of=$(KDIR)/vmlinux.lzma.cfe bs=5 count=1
+	dd if=$(KDIR)/vmlinux.lzma.tmp of=$(KDIR)/vmlinux.lzma.cfe ibs=13 obs=5 skip=1 seek=1 conv=notrunc
+	rm -f $(KDIR)/vmlinux.lzma.tmp
+
+	# Build the LZMA loader
+	rm -f $(KDIR)/loader.gz
+	$(MAKE) -C lzma-loader \
+		BUILD_DIR="$(KDIR)" \
+		TARGET="$(KDIR)" \
+		clean install
+
+	echo -ne "\\x00" >> $(KDIR)/loader.gz
+	rm -f $(KDIR)/fs_mark
+	touch $(KDIR)/fs_mark
+	$(call prepare_generic_squashfs,$(KDIR)/fs_mark)
+endef
+
+define Image/Build
+	dd if=$(KDIR)/root.$(1) of=$(BIN_DIR)/$(IMG_PREFIX)-root.$(1) bs=128k conv=sync
+	# Various routers
+	$(call Image/Build/CFE,$(1),96328avng,6328,96328avng-4M-flash-generic,,--pad 2)
+	$(call Image/Build/CFE,$(1),96328avng,6328,96328avng-8M-flash-generic,,--pad 4)
+	$(call Image/Build/CFE,$(1),96328avng,6328,96328avng-16M-flash-generic,,--pad 8)
+	$(call Image/Build/CFE,$(1),963281TAN,6328,963481TAN-4M-flash-generic,,--pad 2)
+	$(call Image/Build/CFE,$(1),963281TAN,6328,963481TAN-8M-flash-generic,,--pad 4)
+	$(call Image/Build/CFE,$(1),963281TAN,6328,963481TAN-16M-flash-generic,,--pad 8)
+	$(call Image/Build/CFE,$(1),96345GW2,6345,96345GW2-generic)
+	$(call Image/Build/CFE,$(1),96345GW2,6345,96348GW2-bc221,,--layoutver 5)
+	$(call Image/Build/CFE,$(1),96345GW2,6345,92345GW2-rev,OpenWRT-$(REVISION))
+	$(call Image/Build/CFE,$(1),96348GW,6348,96348GW-generic,,)
+	$(call Image/Build/CFE,$(1),96348R,6348,96348R-generic,,)
+	$(call Image/Build/CFE,$(1),96348GW,6348,96348GW-bc221,,--layoutver 5)
+	$(call Image/Build/CFE,$(1),6338GW,6338,6338GW-generic,,)
+	$(call Image/Build/CFE,$(1),6338W,6338,6338W-generic,,)
+	$(call Image/Build/CFE,$(1),96348GW-11,6348,96348GW-11-generic)
+	$(call Image/Build/CFE,$(1),96348GW-10,6348,96348GW-10-generic)
+	$(call Image/Build/CFE,$(1),96348A-122,6348,96348A-122-generic)
+	$(call Image/Build/CFE,$(1),96358VW,6358,96358VW-generic)
+	$(call Image/Build/CFE,$(1),96358VW2,6358,96358VW2-generic)
+	$(call Image/Build/CFE,$(1),96368MVNgr,6368,96368MVNgr-generic)
+	$(call Image/Build/CFE,$(1),96368MVWG,6368,96368MVWG-generic)
+
+	# BT Voyager V210_BTR
+	$(call Image/Build/CFE,$(1),V210_BB,6348,BTV210_BTR,,--layoutver 5)
+	# BT Voyager V210_ROI, V210_WB
+	$(call Image/Build/CFE,$(1),V210,6348,BTV210_ROI_WB,,--layoutver 5)
+	# BT Voyager V2091_BTR
+	$(call Image/Build/CFE,$(1),V2091_BB,6348,BTV2091_BTR,,--layoutver 5)
+	# BT Voyager V2091_ROI, V2091_WB
+	$(call Image/Build/CFE,$(1),V2091,6348,BTV2091_ROI_WB,,--layoutver 5)
+	# BT Voyager V220V, V220V_MGCP_BTR
+	$(call Image/Build/CFE,$(1),RTA1052V,6348,BTV220V_MGCP_BTR,,--layoutver 5)
+	# BT Voyager V2110, V2110_AA, V2110_ROI
+	$(call Image/Build/CFE,$(1),V2110,6348,BTV2110,,--layoutver 5)
+	# BT Voyager V2500V, V2500V_SIP_CLUB, V2500V_AA
+	$(call Image/Build/CFE,$(1),V2500V_BB,6348,BTV2500V,,--layoutver 5)
+	# RTA1025W_16 (numerous routers)
+	$(call Image/Build/CFE,$(1),RTA1025W_16,6348,RTA1025W_16,,--layoutver 5)
+	# RTA1320_16M (numerous routers)
+	$(call Image/Build/CFE,$(1),RTA1320_16M,6338,RTA1320_16M,,--layoutver 5)
+	# Tecom GW6000
+	$(call Image/Build/CFEFIXUP,$(1),96348GW,GW6000,6348,GW6000)
+	# Tecom GW6200
+	$(call Image/Build/CFEFIXUP,$(1),96348GW,GW6200,6348,GW6200,$(shell printf '\x99'))
+	# Neufbox4
+	$(call Image/Build/CFE,$(1),96358VW,6358,NEUFBOX4,OpenWRT-$(REVISION))
+	# Neufbox6
+	$(call Image/Build/CFE,$(1),NB6-SER-r0,6362,NEUFBOX6,OpenWRT-$(REVISION))
+	# Comtrend 6373
+	$(call Image/Build/CFE,$(1),CT6373-1,6358,CT6373)
+	# Comtrend 536, 5621
+	$(call Image/Build/CFEFIXUP,$(1),96348GW-11,CT536_CT5621,6348,CT536_CT5621)
+	# Davolink DV201AMR
+	$(call Image/Build/CFEOLD,$(1),DV201AMR,6348)
+	# USR 9108
+	$(call Image/Build/CFE,$(1),96348GW-A,6348,USR9108)
+	# NetGear DG834GT, DG834PN
+	$(call Image/Build/CFE,$(1),96348GW-10,6348,DG834GT_DG834PN)
+	# Belkin f5d7633
+	$(call Image/Build/CFE,$(1),96348GW-10,6348,F5D7633)
+	# D-Link DSL-2640B, rev B2
+	$(call Image/Build/CFE,$(1),D-4P-W,6348,DSL2640B-B2)
+	# D-Link DSL-2650U
+	$(call Image/Build/CFE,$(1),96358VW2,6358,DSL2650U)
+	# D-Link DSL-2740B/DSL-2741B, rev C2
+	$(call Image/Build/CFEFIXUP,$(1),96358GW,AW4139,6358,DSL274XB-C2)
+	# D-Link DSL-2740B/DSL-2741B, rev C3
+	$(call Image/Build/CFE,$(1),AW4139,6358,DSL274XB-C3)
+	# D-Link DSL-2740B/DSL-2741B, rev F1
+	$(call Image/Build/CFE,$(1),AW4339U,6328,DSL274XB-F1-EU,,--signature2="4.06.01.EUF1" --pad 4)
+	$(call Image/Build/CFE,$(1),AW4339U,6328,DSL274XB-F1-AU,,--signature2="4.06.01.AUF1" --pad 4)
+	# D-Link DVA-G3810BN/TL
+	$(call Image/Build/CFEFIXUP,$(1),96358VW,DVAG3810BN,6358,DVAG3810BN)
+
+	# TP-Link TD-8810A, TD-8810B, TD-8811A, TD-8811B
+	$(call Image/Build/CFE,$(1),8L-2M-8M,6338,TP8810_8811)
+	# TP-Link 8900GB
+	$(call Image/Build/CFE,$(1),96348GW-11,6348,TD8900GB,$(shell printf 'PRID\x89\x10\x00\x02'))
+
+	# Sagem F@ST2404
+	$(call Image/Build/CFE,$(1),F@ST2404,6348,F@ST2404-cfe)
+	$(call Image/Build/CFE,$(1),F@ST2404,6348,F@ST2404,OpenWRT-$(REVISION))
+	# Inventel Livebox
+	$(call Image/Build/RedBoot,livebox)
+	# Pirelli Alice Gate VoIP 2 Plus Wi-Fi AGPF-S0
+	$(call Image/Build/CFEAGPF,$(1),AGPF-S0,6358,0x20000,AGV2+W-cfe)
+	$(call Image/Build/CFEAGPF,$(1),AGPF-S0,6358,0x20000,AGV2+W)
+	# Pirelli A226G
+	$(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G-cfe)
+	$(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x10000,A226G)
+
+	# Pirelli A226M
+	$(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x20000,A226M-cfe)
+	$(call Image/Build/CFEAGPF,$(1),DWV-S0,6358,0x20000,A226M)
+
+	# RG100A,DB120 etc.
+	$(call Image/Build/RG100A,$(1),96358VW2,6358,0x20000,RG100A_DB120)
+
+	# Telsey CPVA642-type (e.g. CPA-ZNTE60T)
+	$(call Image/Build/CFE,$(1),CPVA642,6358,CPA-ZNTE60T,,--signature "Telsey Tlc",--signature2 "99.99.999",--second-image-flag "0")
+
+	# T-Com Speedport W 500V
+	$(call Image/Build/CFEFIXUP,$(1),96348GW,SPW500V,6348,SPW500V)
+
+	#HW553
+	$(call Image/Build/CFEHW553,$(1),HW553,6358,0x20000,HW553)
+
+	# T-Com Speedport W 303V Typ B
+	$(call Image/Build/SPW303V,$(1),96358-502V,6358,SPW303V)
+endef
+
+$(eval $(call BuildImage))
diff --git a/target/linux/brcm63xx/image/README.images-bcm63xx b/target/linux/brcm63xx/image/README.images-bcm63xx
new file mode 100644
index 000000000..91b6d019e
--- /dev/null
+++ b/target/linux/brcm63xx/image/README.images-bcm63xx
@@ -0,0 +1,127 @@
+The image neede to flash onto a Broadcom 63xx-series board depends on the
+board, method you are using to flash, and, for web-based flash, on the version
+of the Broadcom code your router uses.
+
+There are two major revisions of the Broadcom code as far as imagetags are
+concerned, before 3.08 and after 3.08, however there are some variations 
+within in that, either due to vendor differences or due to changes at 
+Broadcom (it's not clear yet which is the case).  In addtion Pirelli modified
+the Broadcom code, so Alice Gate models use a different imagetag than any 
+other vendor.
+
+The imagetag format for flashing via CFE is the same for almost all the 
+boards, and is the same for all images generated by the imagetag utility.
+Images flashable using cfe are labelled openwrt-<board>-<filesystem>-cfe.bin
+
+The imagetags for tftp/ftp flashing is based on Broadcom 3.00-3.04 imagetags
+and is known to be correct as the source code GPL and is available for reading.
+
+Broadcom code 2.21 is based on the BT Voyager firmware image I looked at.  It
+may in fact be BT Voyager-specific.  2.21 is actually more difficult to deal
+with the imagetag from 3.00 as it has three different CRC calculations in
+addtition to the header CRC.
+
+Broadcom 3.00-3.02 flashing has been tested on Comtrend CT-5261, CT-536 and 
+Tecom GW6000, and is the version of the flashing that was present before the
+imagetags were split by broadcom code version (early June 2009)
+
+3.04 is guessed to be the same as 3.00-3.02 based on available information
+
+Broadom 3.06 is thought to be the same as 3.00-3.02, however the only 3.06 
+this author (Daniel Dickinson) has seen is the Alice Gate (Pirelli) firmware
+which is known to be different due to vendor (Pirelli) modifications to the
+Broadcom code.
+
+Broadcom 3.10 uses an imagetag that is believed to apply to all 3.10 and 3.12
+versions, and has been tested on the Tecom GW6200.  This version introdec changes to
+the imagetag to deal with TR69 (a remote rouer management system developed by the
+DSL forum).  There is a field for vendor-specific information, that at least in some
+cases is not optional.  It is based on the hexedit of a neufbox4 firmware image, the
+information in https://dev.openwrt.org/ticket/4987, and the hexedit of a Tecom
+GW6200 image.
+
+Some boards share the same tag format, but require vendor-specific fields in
+the board.  In that case the tagid is shared, but the filename of the generated
+image reflects the router for which the image was created.
+
+router        |method       | codever |filename
++-------------+-------------+---------+---------------------------------------
+|any          |cfe+most web |   any   |openwrt-<board>-<fs>-cfe.bin
+|AGVoIP2+WiFi |cfe          |alice3.06|openwrt-AGV2+W-cfe-<fs>-cfe.bin
+|AGVoIP2+WiFi |web          |alice3.06|openwrt-AGV2+W-cfe-<fs>-cfe.bin
+|CT536        |web          |3.02     |openwrt-CT536_CT5621-<fs>-cfe.bin
+|CT5621       |web          |3.02     |openwrt-CT536_CT5621-<fs>-cfe.bin
+|DG834GT      |web          |3.02     |openwrt-DG834GT_DG834PN-<fs>-cfe.bin
+|DG834PN      |web          |3.02     |openwrt-DG834GT_DG834PN-<fs>-cfe.bin
+|DSL-2640B    |web          |3.10     |openwrt-DSL2640B-<fs>-cfe.bin
+|DSL-2740B    |web          |3.10     |openwrt-DSL2670B-<fs>-cfe.bin
+|F5D7633      |web          |3.10     |openwrt-F5D7633-<fs>-cfe.bin
+|F@ST2404     |web          |3.0X?    |openwrt-F@ST2404-cfe-<fs>-cfe.bin
+|F@ST2404     |web          |3.1X?    |openwrt-F@ST2404-<fs>-cfe.bin
+|GW6000       |web          |3.00     |openwrt-GW6000-<fs>-cfe.bin
+|GW6200       |web          |3.10     |openwrt-GW6200-<fs>-cfe.bin
+|Neufbox4     |web          |3.12     |openwrt-NEUFBOX4-<fs>-cfe.bin
+|TD8810A      |web          |3.06     |openwrt-TD8810-<fs>-cfe.bin
+|TD8810B      |web          |3.06     |openwrt-TD8810-<fs>-cfe.bin
+|TD8811A      |web          |3.06     |openwrt-TD8811-<fs>-cfe.bin
+|TD8811B      |web          |3.06     |openwrt-TD881-<fs>-cfe.bin
+|TD8900GB     |web          |3.06     |openwrt-TD8900DB<fs>-cfe.bin
+|USR9108      |web          |3.0X?    |openwrt-USR9108-<fs>-cfe.bin
+|V2091_BTR    |web          |2.21     |openwrt-V2091_BTR-<fs>-cfe.bin
+|V2091_ROI    |web          |2.21     |openwrt-V2091-<fs>-cfe.bin
+|V2091_WB     |web          |2.21     |openwrt-V2091-<fs>-cfe.bin
+|V210_BTR     |web          |2.21     |openwrt-V210_BTR-<fs>-cfe.bin
+|V210_ROI     |web          |2.21     |openwrt-V210-ROI_WB<fs>-cfe.bin
+|V210_WB      |web          |2.21     |openwrt-V210-ROI_WB<fs>-cfe.bin
+|V2110        |web          |2.21     |openwrt-V2110-<fs>-cfe.bin
+|V2110_AA     |web          |2.21     |openwrt-V2110-<fs>-cfe.bin
+|V2110_ROI    |web          |2.21     |openwrt-V2110-<fs>-cfe.bin
+|V2500V       |web          |2.21     |openwrt-V2500V<fs>-cfe.bin
+|V2500V_AA    |web          |2.21     |openwrt-V2500V-<fs>-cfe.bin
+|V2500V_SIP_CLUB |web       |2.21     |openwrt-V2500V-<fs>-cfe.bin
+
+Old imagetag routers
+--------------------
+Davolink DV201AMR
+
+Redboot routers
+---------------
+Inventel Livebox
+
+Known router->code versions
+---------------------------
+
+Vendor                     |Model                                     |Code Ver
+---------------------------+------------------------------------------+--------
+Belkin                     |F5D7633                                   |3.10
+British Telecom (BT)       |Voyager V2091_BTR                         |2.21
+British Telecom (BT)       |Voyager V2091_ROI                         |2.21
+British Telecom (BT)       |Voyager V2091_WB                          |2.21
+British Telecom (BT)       |Voyager V210_BTR                          |2.21
+British Telecom (BT)       |Voyager V210_ROI                          |2.21
+British Telecom (BT)       |Voyager V210_WB                           |2.21
+British Telecom (BT)       |Voyager V2110                             |2.21
+British Telecom (BT)       |Voyager V2110_AA                          |2.21
+British Telecom (BT)       |Voyager V2110_ROI                         |2.21
+British Telecom (BT)       |Voyager V220V                             |2.21
+British Telecom (BT)       |Voyager V2500V                            |2.21
+British Telecom (BT)       |Voyager V2500V_AA                         |2.21
+British Telecom (BT)       |Voyager V2500V_SIP_CLUB                   |2.21
+Comtrend                   |CT-5261                                   |3.02
+Comtrend                   |CT-536                                    |3.02
+D-Link                     |DSL-2640B                                 |3.10
+D-Link                     |DSL-2670B                                 |3.10
+NetGear			   |DG834GT				      |3.02
+NetGear			   |DG834PN				      |3.02
+Neuf Cegetel               |Neufbox 4                                 |3.12
+Pirelli                    |Alice Gate Wi-Fi (+VoIP models?)          |ag 3.06
+Sagem			   |F@ST2404				      |?
+TP-Link                    |TD-8810A                                  |3.06
+TP-Link			   |TD-8810B				      |3.06
+TP-Link			   |TD-8811A				      |3.06
+TP-Link			   |TD-8811B				      |3.06
+TP-Link			   |TD-W8900GB				      |3.06
+Tecom                      |GW6000                                    |3.00
+Tecom                      |GW6200                                    |3.10
+USR			   |9108				      |?
+
diff --git a/target/linux/brcm63xx/image/lzma-loader/Makefile b/target/linux/brcm63xx/image/lzma-loader/Makefile
new file mode 100644
index 000000000..5dd6f5097
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/Makefile
@@ -0,0 +1,33 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME := lzma-loader
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
+
+$(PKG_BUILD_DIR)/.prepared:
+	mkdir $(PKG_BUILD_DIR)
+	$(CP) ./src/* $(PKG_BUILD_DIR)/
+	touch $@
+
+$(PKG_BUILD_DIR)/loader.gz: $(PKG_BUILD_DIR)/.prepared
+	$(MAKE) -C $(PKG_BUILD_DIR) CC="$(TARGET_CC)" \
+		LD="$(TARGET_CROSS)ld" CROSS_COMPILE="$(TARGET_CROSS)"
+
+download: 
+prepare: $(PKG_BUILD_DIR)/.prepared
+compile: $(PKG_BUILD_DIR)/loader.gz
+install:
+
+ifneq ($(TARGET),)
+install: compile
+	$(CP) $(PKG_BUILD_DIR)/loader.gz $(PKG_BUILD_DIR)/loader.elf $(TARGET)/
+endif
+
+clean:
+	rm -rf $(PKG_BUILD_DIR)
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c
new file mode 100644
index 000000000..951700bdd
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.c
@@ -0,0 +1,663 @@
+/*
+  LzmaDecode.c
+  LZMA Decoder
+  
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#include "LzmaDecode.h"
+
+#ifndef Byte
+#define Byte unsigned char
+#endif
+
+#define kNumTopBits 24
+#define kTopValue ((UInt32)1 << kNumTopBits)
+
+#define kNumBitModelTotalBits 11
+#define kBitModelTotal (1 << kNumBitModelTotalBits)
+#define kNumMoveBits 5
+
+typedef struct _CRangeDecoder
+{
+  Byte *Buffer;
+  Byte *BufferLim;
+  UInt32 Range;
+  UInt32 Code;
+  #ifdef _LZMA_IN_CB
+  ILzmaInCallback *InCallback;
+  int Result;
+  #endif
+  int ExtraBytes;
+} CRangeDecoder;
+
+Byte RangeDecoderReadByte(CRangeDecoder *rd)
+{
+  if (rd->Buffer == rd->BufferLim)
+  {
+    #ifdef _LZMA_IN_CB
+    UInt32 size;
+    rd->Result = rd->InCallback->Read(rd->InCallback, &rd->Buffer, &size);
+    rd->BufferLim = rd->Buffer + size;
+    if (size == 0)
+    #endif
+    {
+      rd->ExtraBytes = 1;
+      return 0xFF;
+    }
+  }
+  return (*rd->Buffer++);
+}
+
+/* #define ReadByte (*rd->Buffer++) */
+#define ReadByte (RangeDecoderReadByte(rd))
+
+void RangeDecoderInit(CRangeDecoder *rd,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    Byte *stream, UInt32 bufferSize
+  #endif
+    )
+{
+  int i;
+  #ifdef _LZMA_IN_CB
+  rd->InCallback = inCallback;
+  rd->Buffer = rd->BufferLim = 0;
+  #else
+  rd->Buffer = stream;
+  rd->BufferLim = stream + bufferSize;
+  #endif
+  rd->ExtraBytes = 0;
+  rd->Code = 0;
+  rd->Range = (0xFFFFFFFF);
+  for(i = 0; i < 5; i++)
+    rd->Code = (rd->Code << 8) | ReadByte;
+}
+
+#define RC_INIT_VAR UInt32 range = rd->Range; UInt32 code = rd->Code;        
+#define RC_FLUSH_VAR rd->Range = range; rd->Code = code;
+#define RC_NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | ReadByte; }
+
+UInt32 RangeDecoderDecodeDirectBits(CRangeDecoder *rd, int numTotalBits)
+{
+  RC_INIT_VAR
+  UInt32 result = 0;
+  int i;
+  for (i = numTotalBits; i > 0; i--)
+  {
+    /* UInt32 t; */
+    range >>= 1;
+
+    result <<= 1;
+    if (code >= range)
+    {
+      code -= range;
+      result |= 1;
+    }
+    /*
+    t = (code - range) >> 31;
+    t &= 1;
+    code -= range & (t - 1);
+    result = (result + result) | (1 - t);
+    */
+    RC_NORMALIZE
+  }
+  RC_FLUSH_VAR
+  return result;
+}
+
+int RangeDecoderBitDecode(CProb *prob, CRangeDecoder *rd)
+{
+  UInt32 bound = (rd->Range >> kNumBitModelTotalBits) * *prob;
+  if (rd->Code < bound)
+  {
+    rd->Range = bound;
+    *prob += (kBitModelTotal - *prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 0;
+  }
+  else
+  {
+    rd->Range -= bound;
+    rd->Code -= bound;
+    *prob -= (*prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 1;
+  }
+}
+
+#define RC_GET_BIT2(prob, mi, A0, A1) \
+  UInt32 bound = (range >> kNumBitModelTotalBits) * *prob; \
+  if (code < bound) \
+    { A0; range = bound; *prob += (kBitModelTotal - *prob) >> kNumMoveBits; mi <<= 1; } \
+  else \
+    { A1; range -= bound; code -= bound; *prob -= (*prob) >> kNumMoveBits; mi = (mi + mi) + 1; } \
+  RC_NORMALIZE
+
+#define RC_GET_BIT(prob, mi) RC_GET_BIT2(prob, mi, ; , ;)               
+
+int RangeDecoderBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = numLevels; i > 0; i--)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT(prob, mi)
+    #else
+    mi = (mi + mi) + RangeDecoderBitDecode(probs + mi, rd);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return mi - (1 << numLevels);
+}
+
+int RangeDecoderReverseBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  int symbol = 0;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = 0; i < numLevels; i++)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT2(prob, mi, ; , symbol |= (1 << i))
+    #else
+    int bit = RangeDecoderBitDecode(probs + mi, rd);
+    mi = mi + mi + bit;
+    symbol |= (bit << i);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecode(CProb *probs, CRangeDecoder *rd)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + symbol;
+    RC_GET_BIT(prob, symbol)
+    #else
+    symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+    #endif
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecodeMatch(CProb *probs, CRangeDecoder *rd, Byte matchByte)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    int bit;
+    int matchBit = (matchByte >> 7) & 1;
+    matchByte <<= 1;
+    #ifdef _LZMA_LOC_OPT
+    {
+      CProb *prob = probs + ((1 + matchBit) << 8) + symbol;
+      RC_GET_BIT2(prob, symbol, bit = 0, bit = 1)
+    }
+    #else
+    bit = RangeDecoderBitDecode(probs + ((1 + matchBit) << 8) + symbol, rd);
+    symbol = (symbol << 1) | bit;
+    #endif
+    if (matchBit != bit)
+    {
+      while (symbol < 0x100)
+      {
+        #ifdef _LZMA_LOC_OPT
+        CProb *prob = probs + symbol;
+        RC_GET_BIT(prob, symbol)
+        #else
+        symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+        #endif
+      }
+      break;
+    }
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+#define kNumPosBitsMax 4
+#define kNumPosStatesMax (1 << kNumPosBitsMax)
+
+#define kLenNumLowBits 3
+#define kLenNumLowSymbols (1 << kLenNumLowBits)
+#define kLenNumMidBits 3
+#define kLenNumMidSymbols (1 << kLenNumMidBits)
+#define kLenNumHighBits 8
+#define kLenNumHighSymbols (1 << kLenNumHighBits)
+
+#define LenChoice 0
+#define LenChoice2 (LenChoice + 1)
+#define LenLow (LenChoice2 + 1)
+#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
+#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
+#define kNumLenProbs (LenHigh + kLenNumHighSymbols) 
+
+int LzmaLenDecode(CProb *p, CRangeDecoder *rd, int posState)
+{
+  if(RangeDecoderBitDecode(p + LenChoice, rd) == 0)
+    return RangeDecoderBitTreeDecode(p + LenLow +
+        (posState << kLenNumLowBits), kLenNumLowBits, rd);
+  if(RangeDecoderBitDecode(p + LenChoice2, rd) == 0)
+    return kLenNumLowSymbols + RangeDecoderBitTreeDecode(p + LenMid +
+        (posState << kLenNumMidBits), kLenNumMidBits, rd);
+  return kLenNumLowSymbols + kLenNumMidSymbols + 
+      RangeDecoderBitTreeDecode(p + LenHigh, kLenNumHighBits, rd);
+}
+
+#define kNumStates 12
+
+#define kStartPosModelIndex 4
+#define kEndPosModelIndex 14
+#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
+
+#define kNumPosSlotBits 6
+#define kNumLenToPosStates 4
+
+#define kNumAlignBits 4
+#define kAlignTableSize (1 << kNumAlignBits)
+
+#define kMatchMinLen 2
+
+#define IsMatch 0
+#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
+#define IsRepG0 (IsRep + kNumStates)
+#define IsRepG1 (IsRepG0 + kNumStates)
+#define IsRepG2 (IsRepG1 + kNumStates)
+#define IsRep0Long (IsRepG2 + kNumStates)
+#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
+#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
+#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
+#define LenCoder (Align + kAlignTableSize)
+#define RepLenCoder (LenCoder + kNumLenProbs)
+#define Literal (RepLenCoder + kNumLenProbs)
+
+#if Literal != LZMA_BASE_SIZE
+StopCompilingDueBUG
+#endif
+
+#ifdef _LZMA_OUT_READ
+
+typedef struct _LzmaVarState
+{
+  CRangeDecoder RangeDecoder;
+  Byte *Dictionary;
+  UInt32 DictionarySize;
+  UInt32 DictionaryPos;
+  UInt32 GlobalPos;
+  UInt32 Reps[4];
+  int lc;
+  int lp;
+  int pb;
+  int State;
+  int PreviousIsMatch;
+  int RemainLen;
+} LzmaVarState;
+
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+    #else
+    unsigned char *inStream, UInt32 inSize
+    #endif
+    )
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  UInt32 i;
+  if (bufferSize < numProbs * sizeof(CProb) + sizeof(LzmaVarState))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  vs->Dictionary = dictionary;
+  vs->DictionarySize = dictionarySize;
+  vs->DictionaryPos = 0;
+  vs->GlobalPos = 0;
+  vs->Reps[0] = vs->Reps[1] = vs->Reps[2] = vs->Reps[3] = 1;
+  vs->lc = lc;
+  vs->lp = lp;
+  vs->pb = pb;
+  vs->State = 0;
+  vs->PreviousIsMatch = 0;
+  vs->RemainLen = 0;
+  dictionary[dictionarySize - 1] = 0;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&vs->RangeDecoder, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+  );
+  return LZMA_RESULT_OK;
+}
+
+int LzmaDecode(unsigned char *buffer, 
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  CRangeDecoder rd = vs->RangeDecoder;
+  int state = vs->State;
+  int previousIsMatch = vs->PreviousIsMatch;
+  Byte previousByte;
+  UInt32 rep0 = vs->Reps[0], rep1 = vs->Reps[1], rep2 = vs->Reps[2], rep3 = vs->Reps[3];
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << (vs->pb)) - 1;
+  UInt32 literalPosMask = (1 << (vs->lp)) - 1;
+  int lc = vs->lc;
+  int len = vs->RemainLen;
+  UInt32 globalPos = vs->GlobalPos;
+
+  Byte *dictionary = vs->Dictionary;
+  UInt32 dictionarySize = vs->DictionarySize;
+  UInt32 dictionaryPos = vs->DictionaryPos;
+
+  if (len == -1)
+  {
+    *outSizeProcessed = 0;
+    return LZMA_RESULT_OK;
+  }
+
+  while(len > 0 && nowPos < outSize)
+  {
+    UInt32 pos = dictionaryPos - rep0;
+    if (pos >= dictionarySize)
+      pos += dictionarySize;
+    outStream[nowPos++] = dictionary[dictionaryPos] = dictionary[pos];
+    if (++dictionaryPos == dictionarySize)
+      dictionaryPos = 0;
+    len--;
+  }
+  if (dictionaryPos == 0)
+    previousByte = dictionary[dictionarySize - 1];
+  else
+    previousByte = dictionary[dictionaryPos - 1];
+#else
+
+int LzmaDecode(
+    Byte *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+    #else
+    unsigned char *inStream, UInt32 inSize,
+    #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  CProb *p = (CProb *)buffer;
+  CRangeDecoder rd;
+  UInt32 i;
+  int state = 0;
+  int previousIsMatch = 0;
+  Byte previousByte = 0;
+  UInt32 rep0 = 1, rep1 = 1, rep2 = 1, rep3 = 1;
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << pb) - 1;
+  UInt32 literalPosMask = (1 << lp) - 1;
+  int len = 0;
+  if (bufferSize < numProbs * sizeof(CProb))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&rd, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+      );
+#endif
+
+  *outSizeProcessed = 0;
+  while(nowPos < outSize)
+  {
+    int posState = (int)(
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & posStateMask);
+    #ifdef _LZMA_IN_CB
+    if (rd.Result != LZMA_RESULT_OK)
+      return rd.Result;
+    #endif
+    if (rd.ExtraBytes != 0)
+      return LZMA_RESULT_DATA_ERROR;
+    if (RangeDecoderBitDecode(p + IsMatch + (state << kNumPosBitsMax) + posState, &rd) == 0)
+    {
+      CProb *probs = p + Literal + (LZMA_LIT_SIZE * 
+        (((
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & literalPosMask) << lc) + (previousByte >> (8 - lc))));
+
+      if (state < 4) state = 0;
+      else if (state < 10) state -= 3;
+      else state -= 6;
+      if (previousIsMatch)
+      {
+        Byte matchByte;
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        matchByte = dictionary[pos];
+        #else
+        matchByte = outStream[nowPos - rep0];
+        #endif
+        previousByte = LzmaLiteralDecodeMatch(probs, &rd, matchByte);
+        previousIsMatch = 0;
+      }
+      else
+        previousByte = LzmaLiteralDecode(probs, &rd);
+      outStream[nowPos++] = previousByte;
+      #ifdef _LZMA_OUT_READ
+      dictionary[dictionaryPos] = previousByte;
+      if (++dictionaryPos == dictionarySize)
+        dictionaryPos = 0;
+      #endif
+    }
+    else             
+    {
+      previousIsMatch = 1;
+      if (RangeDecoderBitDecode(p + IsRep + state, &rd) == 1)
+      {
+        if (RangeDecoderBitDecode(p + IsRepG0 + state, &rd) == 0)
+        {
+          if (RangeDecoderBitDecode(p + IsRep0Long + (state << kNumPosBitsMax) + posState, &rd) == 0)
+          {
+            #ifdef _LZMA_OUT_READ
+            UInt32 pos;
+            #endif
+            if (
+               (nowPos 
+                #ifdef _LZMA_OUT_READ
+                + globalPos
+                #endif
+               )
+               == 0)
+              return LZMA_RESULT_DATA_ERROR;
+            state = state < 7 ? 9 : 11;
+            #ifdef _LZMA_OUT_READ
+            pos = dictionaryPos - rep0;
+            if (pos >= dictionarySize)
+              pos += dictionarySize;
+            previousByte = dictionary[pos];
+            dictionary[dictionaryPos] = previousByte;
+            if (++dictionaryPos == dictionarySize)
+              dictionaryPos = 0;
+            #else
+            previousByte = outStream[nowPos - rep0];
+            #endif
+            outStream[nowPos++] = previousByte;
+            continue;
+          }
+        }
+        else
+        {
+          UInt32 distance;
+          if(RangeDecoderBitDecode(p + IsRepG1 + state, &rd) == 0)
+            distance = rep1;
+          else 
+          {
+            if(RangeDecoderBitDecode(p + IsRepG2 + state, &rd) == 0)
+              distance = rep2;
+            else
+            {
+              distance = rep3;
+              rep3 = rep2;
+            }
+            rep2 = rep1;
+          }
+          rep1 = rep0;
+          rep0 = distance;
+        }
+        len = LzmaLenDecode(p + RepLenCoder, &rd, posState);
+        state = state < 7 ? 8 : 11;
+      }
+      else
+      {
+        int posSlot;
+        rep3 = rep2;
+        rep2 = rep1;
+        rep1 = rep0;
+        state = state < 7 ? 7 : 10;
+        len = LzmaLenDecode(p + LenCoder, &rd, posState);
+        posSlot = RangeDecoderBitTreeDecode(p + PosSlot +
+            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << 
+            kNumPosSlotBits), kNumPosSlotBits, &rd);
+        if (posSlot >= kStartPosModelIndex)
+        {
+          int numDirectBits = ((posSlot >> 1) - 1);
+          rep0 = ((2 | ((UInt32)posSlot & 1)) << numDirectBits);
+          if (posSlot < kEndPosModelIndex)
+          {
+            rep0 += RangeDecoderReverseBitTreeDecode(
+                p + SpecPos + rep0 - posSlot - 1, numDirectBits, &rd);
+          }
+          else
+          {
+            rep0 += RangeDecoderDecodeDirectBits(&rd, 
+                numDirectBits - kNumAlignBits) << kNumAlignBits;
+            rep0 += RangeDecoderReverseBitTreeDecode(p + Align, kNumAlignBits, &rd);
+          }
+        }
+        else
+          rep0 = posSlot;
+        rep0++;
+      }
+      if (rep0 == (UInt32)(0))
+      {
+        /* it's for stream version */
+        len = -1;
+        break;
+      }
+      if (rep0 > nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+      {
+        return LZMA_RESULT_DATA_ERROR;
+      }
+      len += kMatchMinLen;
+      do
+      {
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        previousByte = dictionary[pos];
+        dictionary[dictionaryPos] = previousByte;
+        if (++dictionaryPos == dictionarySize)
+          dictionaryPos = 0;
+        #else
+        previousByte = outStream[nowPos - rep0];
+        #endif
+        outStream[nowPos++] = previousByte;
+        len--;
+      }
+      while(len > 0 && nowPos < outSize);
+    }
+  }
+
+  #ifdef _LZMA_OUT_READ
+  vs->RangeDecoder = rd;
+  vs->DictionaryPos = dictionaryPos;
+  vs->GlobalPos = globalPos + nowPos;
+  vs->Reps[0] = rep0;
+  vs->Reps[1] = rep1;
+  vs->Reps[2] = rep2;
+  vs->Reps[3] = rep3;
+  vs->State = state;
+  vs->PreviousIsMatch = previousIsMatch;
+  vs->RemainLen = len;
+  #endif
+
+  *outSizeProcessed = nowPos;
+  return LZMA_RESULT_OK;
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h
new file mode 100644
index 000000000..f58944e3c
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/LzmaDecode.h
@@ -0,0 +1,100 @@
+/* 
+  LzmaDecode.h
+  LZMA Decoder interface
+
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#ifndef __LZMADECODE_H
+#define __LZMADECODE_H
+
+/* #define _LZMA_IN_CB */
+/* Use callback for input data */
+
+/* #define _LZMA_OUT_READ */
+/* Use read function for output data */
+
+/* #define _LZMA_PROB32 */
+/* It can increase speed on some 32-bit CPUs, 
+   but memory usage will be doubled in that case */
+
+/* #define _LZMA_LOC_OPT */
+/* Enable local speed optimizations inside code */
+
+#ifndef UInt32
+#ifdef _LZMA_UINT32_IS_ULONG
+#define UInt32 unsigned long
+#else
+#define UInt32 unsigned int
+#endif
+#endif
+
+#ifdef _LZMA_PROB32
+#define CProb UInt32
+#else
+#define CProb unsigned short
+#endif
+
+#define LZMA_RESULT_OK 0
+#define LZMA_RESULT_DATA_ERROR 1
+#define LZMA_RESULT_NOT_ENOUGH_MEM 2
+
+#ifdef _LZMA_IN_CB
+typedef struct _ILzmaInCallback
+{
+  int (*Read)(void *object, unsigned char **buffer, UInt32 *bufferSize);
+} ILzmaInCallback;
+#endif
+
+#define LZMA_BASE_SIZE 1846
+#define LZMA_LIT_SIZE 768
+
+/* 
+bufferSize = (LZMA_BASE_SIZE + (LZMA_LIT_SIZE << (lc + lp)))* sizeof(CProb)
+bufferSize += 100 in case of _LZMA_OUT_READ
+by default CProb is unsigned short, 
+but if specify _LZMA_PROB_32, CProb will be UInt32(unsigned int)
+*/
+
+#ifdef _LZMA_OUT_READ
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    unsigned char *inStream, UInt32 inSize
+  #endif
+);
+#endif
+
+int LzmaDecode(
+    unsigned char *buffer, 
+  #ifndef _LZMA_OUT_READ
+    UInt32 bufferSize,
+    int lc, int lp, int pb,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+  #else
+    unsigned char *inStream, UInt32 inSize,
+  #endif
+  #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed);
+
+#endif
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/Makefile b/target/linux/brcm63xx/image/lzma-loader/src/Makefile
new file mode 100644
index 000000000..83e2c5238
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/Makefile
@@ -0,0 +1,77 @@
+#
+# Makefile for Broadcom BCM947XX boards
+#
+# Copyright 2001-2003, Broadcom Corporation
+# All Rights Reserved.
+# 
+# THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+# KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+# SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+#
+# Copyright 2004  Manuel Novoa III <mjn3@codepoet.org>
+#   Modified to support bzip'd kernels.
+#   Of course, it would be better to integrate bunzip capability into CFE.
+#
+# Copyright 2005  Oleg I. Vdovikin <oleg@cs.msu.su>
+#   Cleaned up, modified for lzma support, removed from kernel
+#
+
+TEXT_START	:= 0x80010000
+BZ_TEXT_START	:= 0x80300000
+
+OBJCOPY		:= $(CROSS_COMPILE)objcopy -O binary -R .reginfo -R .note -R .comment -R .mdebug -S
+
+CFLAGS		= -D__KERNEL__ -Wall -Wstrict-prototypes -Wno-trigraphs -Os \
+		  -fno-strict-aliasing -fno-common -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic \
+		  -ffunction-sections -pipe -mlong-calls -fno-common \
+		  -mabi=32 -march=mips32 -Wa,-32 -Wa,-march=mips32 -Wa,-mips32 -Wa,--trap
+CFLAGS		+= -DLOADADDR=$(TEXT_START) -D_LZMA_IN_CB
+
+ASFLAGS		= $(CFLAGS) -D__ASSEMBLY__ -DBZ_TEXT_START=$(BZ_TEXT_START)
+
+SEDFLAGS	:= s/BZ_TEXT_START/$(BZ_TEXT_START)/;s/TEXT_START/$(TEXT_START)/
+
+OBJECTS		:= head.o data.o
+
+all: loader.gz loader.elf
+
+# Don't build dependencies, this may die if $(CC) isn't gcc
+dep:
+
+install:
+
+loader.gz: loader
+	gzip -nc9 $< > $@
+
+loader.elf: loader.o
+	cp $< $@
+
+loader: loader.o
+	$(OBJCOPY) $< $@
+
+loader.o: loader.lds $(OBJECTS)
+	$(LD) -static --gc-sections -no-warn-mismatch -T loader.lds -o $@ $(OBJECTS)
+
+loader.lds: loader.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+data.o: data.lds decompress.image
+	$(LD) -no-warn-mismatch -T data.lds -r -o $@ -b binary decompress.image -b elf32-tradlittlemips
+
+data.lds:
+	@echo "SECTIONS { .data : { code_start = .; *(.data) code_stop = .; }}" > $@
+
+decompress.image: decompress
+	$(OBJCOPY) $< $@
+
+decompress: decompress.lds decompress.o LzmaDecode.o
+	$(LD) -static --gc-sections -no-warn-mismatch -T decompress.lds -o $@ decompress.o LzmaDecode.o
+
+decompress.lds: decompress.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+mrproper: clean
+
+clean:
+	rm -f loader.gz loader decompress *.lds *.o *.image
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/README b/target/linux/brcm63xx/image/lzma-loader/src/README
new file mode 100644
index 000000000..16649e950
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/README
@@ -0,0 +1,55 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+The code is intended to decompress kernel, being compressed using lzma utility
+build using 7zip LZMA SDK. This utility is located in the LZMA_Alone directory
+
+decompressor code expects that your .trx file consist of three partitions: 
+
+1) decompressor itself (this is gziped code which pmon/cfe will extract and run
+on boot-up instead of real kernel)
+2) LZMA compressed kernel (both streamed and regular modes are supported now)
+3) Root filesystem
+
+Please be sure to apply the following patch for use this new trx layout (it will
+allow using both new and old trx files for root filesystem lookup code)
+
+--- linuz/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:24:27.503322896 +0300
++++ linux/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:29:05.237100944 +0300
+@@ -221,7 +221,9 @@
+                /* Try looking at TRX header for rootfs offset */
+                if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
+                        bcm947xx_parts[1].offset = off;
+-                       if (le32_to_cpu(trx->offsets[1]) > off)
++                       if (le32_to_cpu(trx->offsets[2]) > off)
++                               off = le32_to_cpu(trx->offsets[2]);
++                       else if (le32_to_cpu(trx->offsets[1]) > off)
+                                off = le32_to_cpu(trx->offsets[1]);
+                        continue;
+                }
+
+
+Revision history:
+	0.02	Initial release
+	0.03	Added Mineharu Takahara <mtakahar@yahoo.com> patch to pass actual
+		output size to decoder (stream mode compressed input is not 
+		a requirement anymore)
+	0.04	Reordered functions using lds script
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/decompress.c b/target/linux/brcm63xx/image/lzma-loader/src/decompress.c
new file mode 100644
index 000000000..ec510e21e
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/decompress.c
@@ -0,0 +1,175 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ *
+ * Please note, this was code based on the bunzip2 decompressor code
+ * by Manuel Novoa III  (mjn3@codepoet.org), although the only thing left
+ * is an idea and part of original vendor code
+ *
+ *
+ * 12-Mar-2005  Mineharu Takahara <mtakahar@yahoo.com>
+ *   pass actual output size to decoder (stream mode
+ *   compressed input is not a requirement anymore)
+ *
+ * 24-Apr-2005 Oleg I. Vdovikin
+ *   reordered functions using lds script, removed forward decl
+ *
+ */
+
+#include "LzmaDecode.h"
+
+#define BCM4710_FLASH		0x1fc00000	/* Flash */
+
+#define KSEG0			0x80000000
+#define KSEG1			0xa0000000
+
+#define KSEG1ADDR(a)		((((unsigned)(a)) & 0x1fffffffU) | KSEG1)
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+#define cache_unroll(base,op)	\
+	__asm__ __volatile__(		\
+		".set noreorder;\n"		\
+		".set mips3;\n"			\
+		"cache %1, (%0);\n"		\
+		".set mips0;\n"			\
+		".set reorder\n"		\
+		:						\
+		: "r" (base),			\
+		  "i" (op));
+
+static __inline__ void blast_icache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Invalidate_I);
+		start += lsize;
+	}
+}
+
+static __inline__ void blast_dcache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Writeback_Inv_D);
+		start += lsize;
+	}
+}
+
+#define TRX_MAGIC       0x30524448      /* "HDR0" */
+
+struct trx_header {
+	unsigned int magic;		/* "HDR0" */
+	unsigned int len;		/* Length of file including header */
+	unsigned int crc32;		/* 32-bit CRC from flag_version to end of file */
+	unsigned int flag_version;	/* 0:15 flags, 16:31 version */
+	unsigned int offsets[3];	/* Offsets of partitions from start of header */
+};
+
+/* beyound the image end, size not known in advance */
+extern unsigned char workspace[];
+
+unsigned int offset;
+unsigned char *data;
+
+/* flash access should be aligned, so wrapper is used */
+/* read byte from the flash, all accesses are 32-bit aligned */
+static int read_byte(void *object, unsigned char **buffer, UInt32 *bufferSize)
+{
+	static unsigned int val;
+
+	if (((unsigned int)offset % 4) == 0) {
+		val = *(unsigned int *)data;
+		data += 4;
+	}
+	
+	*bufferSize = 1;
+	*buffer = ((unsigned char *)&val) + (offset++ & 3);
+	
+	return LZMA_RESULT_OK;
+}
+
+static __inline__ unsigned char get_byte(void)
+{
+	unsigned char *buffer;
+	UInt32 fake;
+	
+	return read_byte(0, &buffer, &fake), *buffer;
+}
+
+/* should be the first function */
+void entry(unsigned long icache_size, unsigned long icache_lsize, 
+	unsigned long dcache_size, unsigned long dcache_lsize)
+{
+	unsigned int i;  /* temp value */
+	unsigned int lc; /* literal context bits */
+	unsigned int lp; /* literal pos state bits */
+	unsigned int pb; /* pos state bits */
+	unsigned int osize; /* uncompressed size */
+
+	ILzmaInCallback callback;
+	callback.Read = read_byte;
+
+	/* look for trx header, 32-bit data access */
+	for (data = ((unsigned char *) KSEG1ADDR(BCM4710_FLASH));
+		((struct trx_header *)data)->magic != TRX_MAGIC; data += 65536);
+
+	/* compressed kernel is in the partition 0 or 1 */
+	if (((struct trx_header *)data)->offsets[1] > 65536) 
+		data += ((struct trx_header *)data)->offsets[0];
+	else
+		data += ((struct trx_header *)data)->offsets[1];
+
+	offset = 0;
+
+	/* lzma args */
+	i = get_byte();
+	lc = i % 9, i = i / 9;
+	lp = i % 5, pb = i / 5;
+
+	/* skip rest of the LZMA coder property */
+	for (i = 0; i < 4; i++)
+		get_byte();
+
+	/* read the lower half of uncompressed size in the header */
+	osize = ((unsigned int)get_byte()) +
+		((unsigned int)get_byte() << 8) +
+		((unsigned int)get_byte() << 16) +
+		((unsigned int)get_byte() << 24);
+
+	/* skip rest of the header (upper half of uncompressed size) */
+	for (i = 0; i < 4; i++) 
+		get_byte();
+
+	/* decompress kernel */
+	if (LzmaDecode(workspace, ~0, lc, lp, pb, &callback,
+		(unsigned char*)LOADADDR, osize, &i) == LZMA_RESULT_OK)
+	{
+		blast_dcache(dcache_size, dcache_lsize);
+		blast_icache(icache_size, icache_lsize);
+
+		/* Jump to load address */
+		((void (*)(void)) LOADADDR)();
+	}
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in b/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in
new file mode 100644
index 000000000..33f56f8a0
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/decompress.lds.in
@@ -0,0 +1,20 @@
+OUTPUT_ARCH(mips)
+ENTRY(entry)
+SECTIONS {
+	. = BZ_TEXT_START;
+	.text : {
+		*(.text.entry)
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+
+	workspace = .;
+}
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/head.S b/target/linux/brcm63xx/image/lzma-loader/src/head.S
new file mode 100644
index 000000000..9bfbd53d5
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/head.S
@@ -0,0 +1,155 @@
+/* Copyright 2005 Oleg I. Vdovikin (oleg@cs.msu.su)	*/
+/* cache manipulation adapted from Broadcom code 	*/
+/* idea taken from original bunzip2 decompressor code	*/
+/* Copyright 2004 Manuel Novoa III (mjn3@codepoet.org)	*/
+/* Licensed under the linux kernel's version of the GPL.*/
+
+#include <asm/asm.h>
+#include <asm/regdef.h>
+
+#define KSEG0		0x80000000
+
+#define C0_CONFIG	$16
+#define C0_TAGLO	$28
+#define C0_TAGHI	$29
+
+#define	CONF1_DA_SHIFT	7			/* D$ associativity */
+#define CONF1_DA_MASK	0x00000380
+#define CONF1_DA_BASE	1
+#define CONF1_DL_SHIFT	10			/* D$ line size */
+#define CONF1_DL_MASK	0x00001c00
+#define CONF1_DL_BASE	2
+#define CONF1_DS_SHIFT	13			/* D$ sets/way */
+#define CONF1_DS_MASK	0x0000e000
+#define CONF1_DS_BASE	64
+#define CONF1_IA_SHIFT	16			/* I$ associativity */
+#define CONF1_IA_MASK	0x00070000
+#define CONF1_IA_BASE	1
+#define CONF1_IL_SHIFT	19			/* I$ line size */
+#define CONF1_IL_MASK	0x00380000
+#define CONF1_IL_BASE	2
+#define CONF1_IS_SHIFT	22			/* Instruction cache sets/way */
+#define CONF1_IS_MASK	0x01c00000
+#define CONF1_IS_BASE	64
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+	.text
+	LEAF(startup)
+	.set noreorder
+	
+	/* Copy decompressor code to the right place */
+	li	t2, BZ_TEXT_START
+	add	a0, t2, 0
+	la      a1, code_start
+	la	a2, code_stop
+$L1:
+	lw	t0, 0(a1)
+	sw	t0, 0(a0)
+	add	a1, 4
+	add	a0, 4
+	blt	a1, a2, $L1
+	nop
+	
+	/* At this point we need to invalidate dcache and */
+	/* icache before jumping to new code */
+
+1:	/* Get cache sizes */
+	.set	mips32
+	mfc0	s0,C0_CONFIG,1
+	.set	mips0
+
+	li	s1,CONF1_DL_MASK
+	and	s1,s0
+	beq	s1,zero,nodc
+	nop
+
+	srl	s1,CONF1_DL_SHIFT
+	li	t0,CONF1_DL_BASE
+	sll	s1,t0,s1		/* s1 has D$ cache line size */
+
+	li	s2,CONF1_DA_MASK
+	and	s2,s0
+	srl	s2,CONF1_DA_SHIFT
+	addiu	s2,CONF1_DA_BASE	/* s2 now has D$ associativity */
+
+	li	t0,CONF1_DS_MASK
+	and	t0,s0
+	srl	t0,CONF1_DS_SHIFT
+	li	s3,CONF1_DS_BASE
+	sll	s3,s3,t0		/* s3 has D$ sets per way */
+
+	multu	s2,s3			/* sets/way * associativity */
+	mflo	t0			/* total cache lines */
+
+	multu	s1,t0			/* D$ linesize * lines */
+	mflo	s2			/* s2 is now D$ size in bytes */
+
+	/* Initilize the D$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s2		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Writeback_Inv_D,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s1
+	
+nodc:
+	/* Now we get to do it all again for the I$ */
+	
+	move	s3,zero			/* just in case there is no icache */
+	move	s4,zero
+
+	li	t0,CONF1_IL_MASK
+	and	t0,s0
+	beq	t0,zero,noic
+	nop
+
+	srl	t0,CONF1_IL_SHIFT
+	li	s3,CONF1_IL_BASE
+	sll	s3,t0			/* s3 has I$ cache line size */
+
+	li	t0,CONF1_IA_MASK
+	and	t0,s0
+	srl	t0,CONF1_IA_SHIFT
+	addiu	s4,t0,CONF1_IA_BASE	/* s4 now has I$ associativity */
+
+	li	t0,CONF1_IS_MASK
+	and	t0,s0
+	srl	t0,CONF1_IS_SHIFT
+	li	s5,CONF1_IS_BASE
+	sll	s5,t0			/* s5 has I$ sets per way */
+
+	multu	s4,s5			/* sets/way * associativity */
+	mflo	t0			/* s4 is now total cache lines */
+
+	multu	s3,t0			/* I$ linesize * lines */
+	mflo	s4			/* s4 is cache size in bytes */
+
+	/* Initilize the I$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s4		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Invalidate_I,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s3
+
+noic:
+	move	a0,s3			/* icache line size */
+	move	a1,s4			/* icache size */
+	move	a2,s1			/* dcache line size */
+	jal	t2
+	move	a3,s2			/* dcache size */
+	
+	.set reorder
+	END(startup)
diff --git a/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in b/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in
new file mode 100644
index 000000000..20f2ea98e
--- /dev/null
+++ b/target/linux/brcm63xx/image/lzma-loader/src/loader.lds.in
@@ -0,0 +1,17 @@
+OUTPUT_ARCH(mips)
+ENTRY(startup)
+SECTIONS {
+	. = TEXT_START;
+	.text : {
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+}