1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
The image neede to flash onto a Broadcom 63xx-series board depends on the
board, method you are using to flash, and, for web-based flash, on the version
of the Broadcom code your router uses.
There are two major revisions of the Broadcom code as far as imagetags are
concerned, before 3.08 and after 3.08, however there are some variations
within in that, either due to vendor differences or due to changes at
Broadcom (it's not clear yet which is the case). In addtion Pirelli modified
the Broadcom code, so Alice Gate models use a different imagetag than any
other vendor.
The imagetag format for flashing via CFE is the same for almost all the
boards, and is the same for all images generated by the imagetag utility.
Images flashable using cfe are labelled openwrt-<board>-<filesystem>-cfe.bin
The imagetags for tftp/ftp flashing is based on Broadcom 3.00-3.04 imagetags
and is known to be correct as the source code GPL and is available for reading.
Broadcom code 2.21 is based on the BT Voyager firmware image I looked at. It
may in fact be BT Voyager-specific. 2.21 is actually more difficult to deal
with the imagetag from 3.00 as it has three different CRC calculations in
addtition to the header CRC.
Broadcom 3.00-3.02 flashing has been tested on Comtrend CT-5261, CT-536 and
Tecom GW6000, and is the version of the flashing that was present before the
imagetags were split by broadcom code version (early June 2009)
3.04 is guessed to be the same as 3.00-3.02 based on available information
Broadom 3.06 is thought to be the same as 3.00-3.02, however the only 3.06
this author (Daniel Dickinson) has seen is the Alice Gate (Pirelli) firmware
which is known to be different due to vendor (Pirelli) modifications to the
Broadcom code.
Broadcom 3.10 uses an imagetag that is believed to apply to all 3.10 and 3.12
versions, and has been tested on the Tecom GW6200. This version introdec changes to
the imagetag to deal with TR69 (a remote rouer management system developed by the
DSL forum). There is a field for vendor-specific information, that at least in some
cases is not optional. It is based on the hexedit of a neufbox4 firmware image, the
information in https://dev.openwrt.org/ticket/4987, and the hexedit of a Tecom
GW6200 image.
Some boards share the same tag format, but require vendor-specific fields in
the board. In that case the tagid is shared, but the filename of the generated
image reflects the router for which the image was created.
router |method | codever |filename
+-------------+-------------+---------+---------------------------------------
|any |cfe+most web | any |openwrt-<board>-<fs>-cfe.bin
|AGVoIP2+WiFi |cfe |alice3.06|openwrt-AGV2+W-cfe-<fs>-cfe.bin
|AGVoIP2+WiFi |web |alice3.06|openwrt-AGV2+W-cfe-<fs>-cfe.bin
|CT536 |web |3.02 |openwrt-CT536_CT5621-<fs>-cfe.bin
|CT5621 |web |3.02 |openwrt-CT536_CT5621-<fs>-cfe.bin
|DG834GT |web |3.02 |openwrt-DG834GT_DG834PN-<fs>-cfe.bin
|DG834PN |web |3.02 |openwrt-DG834GT_DG834PN-<fs>-cfe.bin
|DSL-2640B |web |3.10 |openwrt-DSL2640B-<fs>-cfe.bin
|DSL-2740B |web |3.10 |openwrt-DSL2670B-<fs>-cfe.bin
|F5D7633 |web |3.10 |openwrt-F5D7633-<fs>-cfe.bin
|F@ST2404 |web |3.0X? |openwrt-F@ST2404-cfe-<fs>-cfe.bin
|F@ST2404 |web |3.1X? |openwrt-F@ST2404-<fs>-cfe.bin
|GW6000 |web |3.00 |openwrt-GW6000-<fs>-cfe.bin
|GW6200 |web |3.10 |openwrt-GW6200-<fs>-cfe.bin
|Neufbox4 |web |3.12 |openwrt-NEUFBOX4-<fs>-cfe.bin
|TD8810A |web |3.06 |openwrt-TD8810-<fs>-cfe.bin
|TD8810B |web |3.06 |openwrt-TD8810-<fs>-cfe.bin
|TD8811A |web |3.06 |openwrt-TD8811-<fs>-cfe.bin
|TD8811B |web |3.06 |openwrt-TD881-<fs>-cfe.bin
|TD8900GB |web |3.06 |openwrt-TD8900DB<fs>-cfe.bin
|USR9108 |web |3.0X? |openwrt-USR9108-<fs>-cfe.bin
|V2091_BTR |web |2.21 |openwrt-V2091_BTR-<fs>-cfe.bin
|V2091_ROI |web |2.21 |openwrt-V2091-<fs>-cfe.bin
|V2091_WB |web |2.21 |openwrt-V2091-<fs>-cfe.bin
|V210_BTR |web |2.21 |openwrt-V210_BTR-<fs>-cfe.bin
|V210_ROI |web |2.21 |openwrt-V210-ROI_WB<fs>-cfe.bin
|V210_WB |web |2.21 |openwrt-V210-ROI_WB<fs>-cfe.bin
|V2110 |web |2.21 |openwrt-V2110-<fs>-cfe.bin
|V2110_AA |web |2.21 |openwrt-V2110-<fs>-cfe.bin
|V2110_ROI |web |2.21 |openwrt-V2110-<fs>-cfe.bin
|V2500V |web |2.21 |openwrt-V2500V<fs>-cfe.bin
|V2500V_AA |web |2.21 |openwrt-V2500V-<fs>-cfe.bin
|V2500V_SIP_CLUB |web |2.21 |openwrt-V2500V-<fs>-cfe.bin
Old imagetag routers
--------------------
Davolink DV201AMR
Redboot routers
---------------
Inventel Livebox
Known router->code versions
---------------------------
Vendor |Model |Code Ver
---------------------------+------------------------------------------+--------
Belkin |F5D7633 |3.10
British Telecom (BT) |Voyager V2091_BTR |2.21
British Telecom (BT) |Voyager V2091_ROI |2.21
British Telecom (BT) |Voyager V2091_WB |2.21
British Telecom (BT) |Voyager V210_BTR |2.21
British Telecom (BT) |Voyager V210_ROI |2.21
British Telecom (BT) |Voyager V210_WB |2.21
British Telecom (BT) |Voyager V2110 |2.21
British Telecom (BT) |Voyager V2110_AA |2.21
British Telecom (BT) |Voyager V2110_ROI |2.21
British Telecom (BT) |Voyager V220V |2.21
British Telecom (BT) |Voyager V2500V |2.21
British Telecom (BT) |Voyager V2500V_AA |2.21
British Telecom (BT) |Voyager V2500V_SIP_CLUB |2.21
Comtrend |CT-5261 |3.02
Comtrend |CT-536 |3.02
D-Link |DSL-2640B |3.10
D-Link |DSL-2670B |3.10
NetGear |DG834GT |3.02
NetGear |DG834PN |3.02
Neuf Cegetel |Neufbox 4 |3.12
Pirelli |Alice Gate Wi-Fi (+VoIP models?) |ag 3.06
Sagem |F@ST2404 |?
TP-Link |TD-8810A |3.06
TP-Link |TD-8810B |3.06
TP-Link |TD-8811A |3.06
TP-Link |TD-8811B |3.06
TP-Link |TD-W8900GB |3.06
Tecom |GW6000 |3.00
Tecom |GW6200 |3.10
USR |9108 |?
|
