The Xunison Exigo Hub D50 5G is a 5G/LTE router with Wi-Fi 6. It is also
sold as the Zearts D50 5G.
Specifications:
SoC: Qualcomm IPQ5018, dual-core Cortex-A53 @ 1.0 GHz
RAM: 512 MiB
Flash: 128 MiB SPI NAND (ESMT F50D1G41LB)
WLAN: IPQ5018 2.4 GHz, QCN9074 5 GHz (PCIe), both 802.11ax
Ethernet: 1x GbE WAN (IPQ5018 internal GE PHY, gmac0)
3x GbE LAN (QCA8337 switch, SGMII to gmac1)
WWAN: Quectel RM500Q-AE, 5G Sub-6 / LTE Cat 16, on USB 2.0 and
PCIe
Buttons: reset, WPS
LEDs: MESH (green/red), 5G (green/red), 4G, WiFi, Internet, WAN;
power is hardwired
Power: 12 V / 2 A DC
Serial: 115200 8N1, 4-pin header JP1 next to SW4 on the main board,
from pin 1: VCC, TX, RX, GND
Notes:
- WAN is gmac0 wired straight to the internal GE PHY, not a switch
port; its netdev is named wan by the label property.
- The console RX line (gpio20) is pulled up. Left floating with nothing
on the header it causes an interrupt storm and, on some units, a hang
at boot.
- USB is 2.0 only: the controller is limited to the HS PHY and clocks
its pipe from UTMI. The 5 V supply for the port and the modem is
switched by gpio24 (active low).
- MACs follow the stock firmware: LAN uses 0:art 0x0, WAN 0:art 0x6.
The label has no MAC printed, so there is no label-mac-device.
- Wi-Fi calibration data and MAC addresses come from 0:art through
nvmem cells on the Wi-Fi nodes (calibration: IPQ5018 at 0x1000,
QCN9074 at 0x26800). The caldata holds the Qualcomm placeholder MAC,
so the radios take the 0:art 0x0 MAC + 2 and + 3 instead.
- Board data for both radios is submitted separately to
firmware_qca-wireless under the calibration variant
Xunison-Exigo-Hub-D50-5G, both taken from the stock firmware:
bdwlan.b24-brax for the IPQ5018 and qcn9000/bdwlan.ba0 for the
QCN9074. The brax file is the vendor's board variant; on my unit it
outperformed the bdwlan.b24 that the stock firmware loads.
- The modem power line (gpio31) has no consumer and is kept high with a
GPIO hog.
- The Internet LED is lit while the modem's wwan0 is up. The WiFi LED
uses the network trigger in link mode, so it is lit while an AP is up
on either radio; the phyNradio triggers never light it with ath11k on
this board. The 4G and 5G LEDs have no trigger, as nothing in the
kernel reports the modem's access technology.
Modem:
The RM500Q-AE is wired to both USB and PCIe, and its data_interface
setting selects which one carries data. The stock firmware leaves it on
PCIe (data_interface 1,0) and this port uses it there, so no AT command
is needed after installing. It is driven by mhi-pci-generic with MBIM:
data on wwan0, control on /dev/wwan0mbim0 and AT commands on
/dev/wwan0at0. No modem interface is preconfigured; add one with the
"mbim" protocol on /dev/wwan0mbim0.
Installation:
The factory image is a raw UBI image for the U-Boot web recovery.
1. Power the router off, hold the reset button and power it on. Keep
holding until the Internet LED stays lit (about 10 seconds).
2. Set a computer on a LAN port to 192.168.1.2/24 and open
http://192.168.1.254
3. Upload openwrt-qualcommax-ipq50xx-xunison_exigo-hub-d50-5g-squashfs-factory.img
and wait for the router to reboot.
Later upgrades use the sysupgrade image.
The port started from George Moussalem's device support in the 4IceG
OpenWrt tree, with the device tree reworked by Lukasz Szczur (LS3434):
USB, the modem supply and the NAND/sysupgrade layout. Thanks to Hostle
for the flashing work on this board and to Rafał Wabik (4IceG) for the
tree it was developed in.
Link: https://forum.openwrt.org/t/adding-support-for-xunison-exigo-d50-5g-zearts-d50-5g-ipq5018/247016
Co-developed-by: George Moussalem <george.moussalem@outlook.com>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Co-developed-by: Lukasz Szczur <8sdasfasfas@royaleplaysempire.com>
Signed-off-by: Lukasz Szczur <8sdasfasfas@royaleplaysempire.com>
Co-developed-by: Rafał Wabik <4rafal@gmail.com>
Signed-off-by: Rafał Wabik <4rafal@gmail.com>
Signed-off-by: Steve Meek <stevemeek82@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25890
Signed-off-by: Robert Marko <robimarko@gmail.com>
To reduce code duplication across different AN7583 evaluation boards,
introduce a shared multi-EVB base device tree and utilize Device Tree
Overlays (DTSO) for board-specific configurations.
Signed-off-by: Yalei Zang <yalei.zang@airoha.com>
Link: https://github.com/openwrt/openwrt/pull/24926
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
To reduce code duplication across different AN7581 evaluation boards,
introduce a shared multi-EVB base device tree and utilize Device Tree
Overlays (DTSO) for board-specific configurations.
Signed-off-by: Yalei Zang <yalei.zang@airoha.com>
Link: https://github.com/openwrt/openwrt/pull/24926
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Replace the expanded fixed-partition 128M target with a dedicated
all-in-UBI target and OpenWrt U-Boot. Include bootloader configuration,
image generation and upgrade support together.
Share the fixed-partitions container and read-only 1 MiB BL2 range
in the common DTSI. Declare the remaining partitions and factory NVMEM
data in the variant DTS files. Keep NMBM on the legacy target and preserve
its stock partition map and 64 MiB UBI region.
The new layout uses a 1 MiB bl2 partition followed by a 127 MiB ubi
partition, with factory and fit NVMEM/rootdisk references and redundant
U-Boot environment volumes. Set the UBI variant boot arguments to
`root=/dev/fit0 rootwait` and identify its fit volume as the root disk.
The bootloader supplies memory and console parameters.
Add the U-Boot configuration, default environment and target, recovery
FIT and sysupgrade FIT images, BL2 and BL31/U-Boot artifacts, UBI
environment access and FIT upgrade checks. Recognise the new compatible
in board defaults. Bump the uboot-tools package release for the
new environment configuration support.
The installer creates fip, factory, ubootenv, ubootenv2, recovery and
initial fit volumes. U-Boot and sysupgrade manage the production FIT
and writable rootfs_data. DTS declarations identify volumes consumed
by Linux; they do not themselves create or populate factory data.
MAC address layout
------------------
Factory data is read from the legacy Factory MTD partition or the
factory UBI volume; the offsets within the data are unchanged.
Unit-specific address bytes are xx:xx:xx.
LAN: factory offset 0xe000, mac-base cell index 0.
WAN: factory offset 0xe000, mac-base cell index 1 (LAN MAC + 1).
2.4 GHz: factory offset 0x4, mac-base cell index 0.
5 GHz: factory offset 0x8000, mac-base cell index 0.
Flash instructions
------------------
Conversion requires an installer; the sysupgrade ITB alone cannot
convert the stock partition layout or preserve its factory data.
1. Start from the standard CF-WA933 OpenWrt target with stock MTD
partitions. Back up BL2, u-boot-env, Factory and FIP with mtd dump,
and copy all four files off the device before proceeding:
mtd dump BL2 > /tmp/BL2.bin
mtd dump u-boot-env > /tmp/u-boot-env.bin
mtd dump Factory > /tmp/Factory.bin
mtd dump FIP > /tmp/FIP.bin
2. Obtain the CF-WA933 installer from:
https://github.com/andros-ua/owrt-ubi-installer/releases
Its source and build script are available at:
https://github.com/andros-ua/owrt-ubi-installer/tree/cf-wa933
Connect the PC to a LAN port and use 192.168.1.254/24; the device
is at 192.168.1.1. Copy the resulting image to /tmp and run:
cd /tmp
sysupgrade -n \
openwrt-*-comfast_cf-wa933-ubi-initramfs-recovery-installer.itb
This external installer extracts calibration/MAC data from the old
Factory region before erasing it, creates and populates the static
factory UBI volume, writes BL2 and fip, and creates the redundant
environment, recovery and initial fit volumes. It copies one NAND
eraseblock of factory data; keep the full external Factory backup.
The blue WLAN LED blinks during installation and stays lit for five
seconds before reboot. Run the installer only for initial conversion.
3. Once recovery boots, copy the production image to /tmp and run:
cd /tmp
sysupgrade -n \
openwrt-*-comfast_cf-wa933-ubi-squashfs-sysupgrade.itb
To return to the legacy layout, boot the standard CF-WA933 initramfs
in RAM, restore the saved BL2/u-boot-env/Factory/FIP to their original
MTD partitions (using kmod-mtd-rw when needed), then sysupgrade to the
standard CF-WA933 image. The restored vendor bootloader's recovery
page can install vendor firmware. UART recovery of BL2/FIP is also
available using https://github.com/981213/mtk_uartboot.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Signed-off-by: Guillaume RISCHARD <git@stereo.lu>
Link: https://github.com/openwrt/openwrt/pull/24590
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
The Wallys DR5018S is an IPQ5018-based tri-band Wi-Fi 6E board.
Product specification:
https://www.wallystech.com/upload/DR5018S.pdf
Hardware:
- Qualcomm IPQ5018 SoC
- 512 MB DDR3L RAM
- 8 MB SPI NOR flash (Macronix MX25U6435F)
- 128 MB SPI NAND flash (GigaDevice GD5F1GM7REYIG)
- 1 x 1 GbE LAN port using the integrated GEPHY
- 1 x 2.5 GbE WAN port using a QCA8081 PHY
- 2x2 2.4 GHz Wi-Fi 6 using the integrated radio
- 2x2 5 GHz and 2x2 6 GHz Wi-Fi 6E using QCN6122 radios
- 1 x USB 2.0 pin-header interface
- 1 x reset button
- 4 x blue status LEDs
- UART: J3 next to the USB header, 115200 8N1
- pin 1: 3.3 V (do not connect)
- pin 2: TX
- pin 3: RX
- pin 4: GND
- Power: 12-52 V DC jack, or 802.3at/bt and passive 48 V PoE
(the manufacturer does not publish a DC current rating)
The SPI NOR contains the boot chain, U-Boot environment and ART
partitions. The SPI NAND contains the training area and two 62 MiB
rootfs slots.
Add the device tree, FIT/UBI image definitions, network defaults,
calibration extraction, U-Boot environment access and NAND sysupgrade
support.
MAC addresses:
- LAN: stored in ART at offset 0x0 and read through an NVMEM mac-base cell
- WAN: stored in ART at offset 0x6 and read through an NVMEM mac-base cell
- 2.4 GHz: stored in the ART calibration block at offset 0x100e
- 5 GHz: stored in the ART calibration block at offset 0x2680e
- 6 GHz: stored in the ART calibration block at offset 0x4c00e
The three Wi-Fi calibration blocks are extracted from ART and retain
their stored per-radio MAC addresses; they are not derived from the
Ethernet MAC addresses.
The sysupgrade handler removes OEM-only UBI volumes before creating the
OpenWrt kernel, rootfs and rootfs_data volumes.
Installation:
1. Connect to the J3 serial console and interrupt the vendor U-Boot.
Copy the generated initramfs-uImage.itb to the TFTP root as
initramfs.itb, then configure TFTP and boot it:
setenv serverip 192.168.1.10
setenv ipaddr 192.168.1.1
tftpboot 0x44000000 initramfs.itb
bootm 0x44000000
2. Transfer the generated squashfs-sysupgrade.bin to the device as
/tmp/sysupgrade.bin and install it:
sysupgrade -n /tmp/sysupgrade.bin
Reverting to the vendor firmware has not been tested. Back up the
complete SPI NOR and both SPI NAND rootfs slots before installing
OpenWrt.
Dependencies:
- CMN PLL boot fix: https://github.com/openwrt/openwrt/pull/24653
- Internal radio fix: https://github.com/openwrt/openwrt/pull/24909
- Board data: https://github.com/openwrt/firmware_qca-wireless/pull/149
Tested on a Wallys DR5018S with the dependencies above applied:
- initramfs boot from the vendor U-Boot
- installation to SPI NAND and subsequent sysupgrade
- repeated cold boots
- 1 GbE LAN and 2.5 GbE WAN
- 2.4 GHz, 5 GHz and 6 GHz AP interfaces
- USB 2.0 host-controller registration
- four blue status LED outputs
Signed-off-by: Alan Gao <1226010136@qq.com>
Link: https://github.com/openwrt/openwrt/pull/24910
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add support for Linksys MR2000-family routers based on Qualcomm
IPQ5018, including the MR20WH (LN3111) and MR20EC variants.
Hardware:
- Qualcomm IPQ5018
- 512 MiB RAM
- GigaDevice GD5F2GQ5REYIH 256 MiB SPI-NAND
- QCA8337 switch with four Gigabit LAN ports over SGMII
- dedicated IPQ5018 internal Gigabit Ethernet PHY for WAN
- IPQ5018 2.4 GHz 802.11ax
- QCN6122 5 GHz 802.11ax
- USB host port
- RGB status LED
- reset and WPS buttons
- 12 V / 1.5 A power input
The MR20WH uses the same stock firmware as the MR2000 family, so use
MR2000 as the canonical OpenWrt board identity. The tested hardware
was an MR20WH (LN3111).
The board support was initially derived from the existing MX2000
support, but the MR2000 family differs from the MX2000 in Ethernet
topology, GPIO assignments and NAND partitioning.
UART is available on the four-pin header on the left PCB edge. With
the Ethernet ports facing down, the pins from top to bottom are RX,
TX, GND and +5V. The serial console uses 115200 8N1.
The base MAC address is stored as hw_mac_addr in the devinfo
partition. LAN and WAN use the base address. The 2.4 GHz and 5 GHz
radios use base +1 and base +2 respectively.
Use Qualcomm SMEM partition discovery instead of board-specific
fixed partitions. Retain Linksys dual-bank upgrade handling,
pending further validation of the NAND layout.
The factory image can be installed directly from the stock Linksys
firmware web interface. The factory image now inherits the
MR2000 Linksys image type from the common device recipe.
For recovery and development, initramfs can be loaded from stock
U-Boot using TFTP:
setenv ethact eth1
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.10
tftpboot 0x44000000 <initramfs-image>
bootm 0x44000000
After OpenWrt is installed, use the normal sysupgrade image for
subsequent upgrades.
USB 2.0 hotplug, mass storage and the USB status LED were verified
on hardware. USB 3.0 SuperSpeed was verified at 5000 Mbps using a
RAM-patched device tree with the upstream dual-PHY configuration.
The MR2000-specific IPQ5018 and QCN6122 board files were
extracted from stock Linksys firmware and submitted to
firmware_qca-wireless PR #169. Select the matching MR2000
calibration variants and ipq-wifi package. The firmware source
revision must be updated after the board files are merged.
Add the MR2000 uboot-envtools configuration and register the MR2000-specific ipq-wifi package.
Signed-off-by: Joe Aear <360alaska@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25673
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use RFC 6979 nonces with the staged LibreSSL host tool when
SOURCE_DATE_EPOCH is set. Retry deterministically for full-width
LAN969x signature scalars while preserving random signing otherwise.
Two clean builds produced identical FIP, FWU FIP and FWU HTML outputs.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Use SOURCE_DATE_EPOCH for X.509 validity and hash the unsigned
certificate fields to derive stable serial numbers. The hash includes
payload extensions, so changed firmware gets a new serial.
Retain the existing behavior when the variable is unset and reject
invalid values. ECDSA signatures remain nondeterministic.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Use the published P-256 example key from RFC 6979 for all seven
default development signing roles instead of generating new keys.
Keep role-specific filenames so TFA_KEY_DIR can supply distinct keys.
Pass all supplied keys to both regular and FWU cert_create runs.
Certificate times, serials, and ECDSA signatures still vary.
The public demo key must not be provisioned as a production trust root.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The vendor BL2 of the Wavlink WL-WNT100X3 initializes DDR3 at
1866 MT/s:
NOTICE: BL2: v2.7(release):292bca1-dirty
NOTICE: DDR3 1866MHZ
NOTICE: EMI: Using DDR3 settings
while the plain spim-nand-ddr3 BL2 used by the ubootmod variant runs
DDR3 at the default 2133 MT/s, which is above what the vendor
qualified on this board.
Switch the ubootmod BL2 to the existing DDR3 1866 MT/s build, in line
with the vendor firmware.
Tested on WL-WNT100X3: BL2 reports the ddr3-1866 build, the memory
test passes, U-Boot and OpenWrt boot from UBI.
Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25763
Signed-off-by: Robert Marko <robimarko@gmail.com>
The firmware images of Layerscape boards booting from QSPI, e.g. the
LS1046A-FRWY, differ between builds in 4 bytes at the end of the PBL:
-00009e80: 019f 1e98 0000 0000 0000 0000 0000 0000
+00009e80: e10f e4a8 0000 0000 0000 0000 0000 0000
byte_swap pads the PBL to a multiple of 8 bytes from a 4 byte variable,
so fwrite() reads up to 4 bytes of the stack past it, and an aligned
PBL always gets 8 bytes appended, 4 of them random.
Add a patch that pads with an 8 byte buffer of zeros. The output keeps
its length and layout: for an aligned input only the 4 former random
bytes become zeros, an unaligned input gives the same output as before.
Link: https://github.com/openwrt/openwrt/pull/25720
Signed-off-by: Paul Spooren <mail@aparcar.org>
The Adtran SDG-9000 is a 10G PoE router in a white steel case with
optional 19" rackmount brackets.
Specifications:
* MediaTek MT7988A (4x Cortex-A73)
* 32 GB eMMC
* 4 GiB DDR4 RAM
* 1x 10000M/5000M/2500M/1000M/100M combo WAN: RJ45 (Marvell
CUX3410 PHY) or SFP+ cage, selected at boot
* 1x 10000M/5000M/2500M/1000M/100M LAN port (Marvell CUX3410 PHY)
* 8x 2500M/1000M/100M/10M LAN ports with PoE+ (MaxLinear MxL86282
switch with built-in PHYs), 200 W total PoE budget, two Skyworks
Si3474 PSE controllers
* 1x 1000M/100M/10M management port (MT7988 built-in PHY)
* 240x240 TFT touchscreen (ST7789 SPI LCD with CST816S touch)
* 1 button (Reset)
* uC-controlled RGB LED via I2C
* RGBW LED for each PoE LAN port, 2x LED for the management port,
3x LED for each 10G port, 2x LED for the SFP+ cage
* 2x PWM fan (mainboard, power supply)
* USB 3.0 type A port
* USB-C console port, 115200 baud, Holtek HT42B534 USB-UART bridge
* 100-240V AC 50-60Hz power input, IEC 60320 C14 inlet
The WAN port is selected by a GPIO-controlled mux that has no runtime
control, so it is chosen by one of two device tree overlays, wan-phy
and wan-sfp, carried as configurations of the FIT image. The mux is
selected by setting boot_default_config in the U-Boot environment:
config-1 no WAN port
config-1#mt7988a-smartrg-sdg-9000-wan-phy RJ45 (CUX3410)
config-1#mt7988a-smartrg-sdg-9000-wan-sfp SFP+ cage
MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem
cell index in the DTS is added to the base):
wan xx:xx:xx:xx:xx:x0 MFG_MAC
aux xx:xx:xx:xx:xx:x0 MFG_MAC
lan1-lan9 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
br-lan xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
The label shows MFG_MAC. aux is the only port present when netifd
starts, as lan1-lan9 appear once the mxl862xx driver has loaded, so
br-lan would take the MAC of aux. board.d sets the MAC of br-lan to
that of lan1-lan9.
Installation:
1. Prepare a TFTP server at 192.168.1.254 and serve the OpenWrt
initramfs image, renamed to "openwrt.500".
2. Connect to the Management/Auxilary port.
3. Connect to the USB-C console port (USB CDC-ACM, 115200 8n1)
4. Power on the device and type "st" to enter the U-Boot command
line. The window to do that might be very short, so type it as
soon as the "U-Boot ..." string appears.
5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt
partition by default.
6. Run "bootmenu" and select option 6 (TFTP openwrt image and
boot); "run boot5" is a shortcut for the same. This downloads
openwrt.500 from the TFTP server and boots it.
7. After OpenWrt finishes booting, download the OpenWrt sysupgrade
image and write it to eMMC using "sysupgrade".
8. After sysupgrade finishes writing, the device reboots into
OpenWrt. When the System LED is solid white the device is ready
for configuration.
9. To use the WAN port, set boot_default_config to one of the values
above, e.g. from OpenWrt with
"fw_setenv boot_default_config config-1#mt7988a-smartrg-sdg-9000-wan-sfp".
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The BT-PON BT-G711AX is a fiber modem (ONT) based on RTL9607C.
Specifications:
- SoC : Realtek RTL9607C
- RAM : DDR3 256 MiB
- Flash : SPI-NAND 128 MiB (Windbond)
- Ethernet : 4 port GbE Switch
- Fiber : 1x XPON SC/UPC (Semtech GN25L95)
- Phone : 1x RJ11 (Si32192)
- WIFI : RTL8192XBR + RTL8832BR
- LED : 12x (Power, PON, LOS, LAN1-4, TEL, USB, WPS, Wifi 2.4, Wifi 5)
- UART : 4 pin holes on PCB, 115200 8N1
- Button : 3x (WPS, WLAN, Reset)
- USB : 1x USB 2.0
- Power : 12V DC, 1.5A
This device, and many other devices of this platform, use a
dual-image layout inside a single ubi_device partition.
Intructions to boot initramfs can be found in the previous
commit message.
The networking on this device is not supported yet due to lack of DSA
driver support and thus no MAC addresses interfaces to assign in its
device tree file. But the mdio and cpu gmac are supported so the 4
PHYs and 3 GMAC are described along with 4 switch ports in preperation
for upcoming DSA.
Signed-off-by: Rustam Adilov <adilov@tutamail.com>
Link: https://github.com/openwrt/openwrt/pull/20064
Signed-off-by: John Crispin <john@phrozen.org>
TP-Link RE700X is a dual-band Wi-Fi 6 (AX3000) range extender based on
Qualcomm IPQ5018 (2.4 GHz) with a QCN6122 (5 GHz) companion radio.
Specifications:
- SoC: Qualcomm IPQ5018 (dual-core ARM Cortex-A53)
- RAM: 256 MiB
- Flash: 128 MiB SPI-NAND (ESMT F50D1G41LB)
- Wi-Fi: IPQ5018 2.4 GHz + QCN6122 5 GHz, both 802.11ax
- Ethernet: 1x Gigabit - IPQ5018 MAC1 (DWMAC) via SGMII/uniphy0 to a
Realtek RTL8211F (MDIO1 addr 6). The SoC internal GE PHY (MAC0/gmac0)
is not wired to any external port and stays disabled.
- LEDs: 5, Buttons: reset + WPS
- Power: 100-240 V AC, 50/60 Hz, 0.4 A (internal PSU, wall-plug)
- UART: 3.3 V serial console, 115200 8N1; on-board 4-pad header,
pinout from top: TX, RX, GND, VCC
MAC addresses (factory_data UBI volume, file default-mac, mounted
read-only in preinit like on the EAP650):
- LAN (label MAC): default-mac
- 2.4 GHz: default-mac + 1
- 5 GHz: default-mac + 2
Calibration data is extracted from the 0:art partition (IPQ5018 at
0x1000, QCN6122 at 0x26800).
Installation:
- From OpenWrt (or after a RAM-boot of the initramfs via U-Boot/TFTP):
sysupgrade.
- From the stock firmware: openwrt-...-squashfs-factory-webflash.bin via
the TP-Link web UI (System -> Firmware Upgrade).
scripts/tplink-re700x-factory.py wraps the rootfs UBI into the stock
"nvrammanager" upload container (the same "tplink2022"/safeloader
family as scripts/tplink-mkimage-2022.py); the stock flasher writes it
into the inactive dual-boot slot. This path has not been tested end to
end (no unit on stock firmware was left), so keep UART at hand for a
first install.
The stock U-Boot passes a slot-correct ubi.mtd= (rootfs / rootfs_1 per the
dual-boot index) but with an unmountable root=mtd:ubi_rootfs. The DTS /chosen
inherits ubi.mtd= and appends root=/dev/ubiblock0_1, so OpenWrt boots from
whichever slot the flasher wrote. Like on the EAP650, sysupgrade installs
into the inactive slot and then points tp_boot_idx at it, keeping the
running slot as a fallback; the U-Boot environment is on 0:appsblenv.
The QCN6122/IPQ5018 board-2.bin (BDF) data is supplied via
ipq-wifi-tplink_re700x (openwrt/firmware_qca-wireless).
Wi-Fi is disabled in the DTS for now: with the default ath11k DP ring
sizes both radios exhaust the 256 MiB of RAM. It will be enabled in a
follow-up together with the ath11k patch that selects smaller rings on
low-memory boards, once that has been accepted upstream.
Signed-off-by: Eduard Hart <eduard.hart@etik.com>
Link: https://github.com/openwrt/openwrt/pull/23982
Signed-off-by: Robert Marko <robimarko@gmail.com>
APBoot embeds the current time in both its version banner and generated
U-Boot timestamp header. This makes the AP-32x bootloader artifact
differ between otherwise identical builds.
Use SOURCE_DATE_EPOCH for these timestamps when it is set, while
retaining the wall-clock fallback for other builds.
Signed-off-by: Robert Marko <robimarko@gmail.com>
The FRITZ!Box 4040 U-Boot build embeds the current date and time.
This changes the U-Boot payload and causes the EVA factory image to
differ between otherwise identical builds.
Use SOURCE_DATE_EPOCH to generate the timestamp when it is set, while
retaining the current-time fallback for non-reproducible builds.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
SoC: Qualcomm IPQ5018 (2x Cortex-A53)
RAM: 256 MiB DDR3
Flash: 128 MiB SPI-NAND (ESMT)
Switch: Realtek RTL8367S, 4x GbE (3x LAN + 1x WAN), SGMII CPU port
WiFi: IPQ5018 2.4 GHz, QCN6122 5 GHz, both 802.11ax
LEDs: system (green/amber), WAN, LAN1-3
Button: reset
UART: 115200 8N1, 3.3V, on-board header
Wi-Fi is left disabled: 256 MiB is too few for ath11k, same as on the
ELECOM WRC-X3000GS2.
Notes:
- The label reads "Ver 2.20", but the vendor firmware only ever calls the
board V2: the GPL tree is GPL_MR80Xv2, PRODUCT_NAME is MR80Xv2, the
running system reports "MR80X V2" and the fwup support list carries
product_ver 2.0.0. The trailing digits are a production sub-revision,
so the port is named v2.
- MAC1 runs sgmii through the UNIPHY PCS to RTL8367S port 6. The link is
wired for HSGMII and 2500base-x does come up, but only when gmac1 and
the CPU port carry the same phy-mode: the UNIPHY PCS belongs to the
conduit (pcs-handle = <&uniphy0> in ipq5018-ess.dtsi), so setting the
CPU port alone leaves the switch running HSGMII into a SerDes still
clocked for SGMII.
With both ends at 2500base-x the trunk still dies on some boots: over
12 reboots, 2 came up with the CPU port passing no traffic at all -
eth0 transmitting while s00_p06_ifInOctets stayed at 0, no FCS errors,
the link reporting 2.5 Gbps. That matches the bring-up ordering race
described in openwrt/openwrt#25153, where the switch end of the trunk
is configured before the IPQ5018 UNIPHY resets and recalibrates its
PLL. sgmii has not reproduced it, so the port ships at sgmii until
that fix lands.
- MAC addresses come from default-mac in the vendor tp_data UBI volume,
6 raw bytes at offset 0, mounted read-only during preinit:
label default-mac
LAN default-mac
WAN default-mac + 1
2.4 GHz default-mac - 1
5 GHz default-mac - 2
- Sysupgrade A/B ping-pongs rootfs/rootfs_1 via tp_boot_idx, switched
only after the new slot is fully written. primaryboot stays 0, the
stock loader and the button recovery rely on it.
- factory.bin is wrapped in the Mercusys fwup container the stock web UI
accepts (scripts/mercusys-fwup.py). The generic tplink-image-2022
container is rejected: the loader picks its verification algorithm from
the fw-type string, which that container does not write.
- The board needs the backported spi-qpic-snand ECC context fix,
otherwise about half of the boots end in "Waiting for root device
/dev/ubiblock0_1".
Installation:
In the stock web UI go to Advanced -> System -> Firmware Update ->
Local Update, browse for
openwrt-qualcommax-ipq50xx-mercusys_mr80x-v2-squashfs-factory.bin
and press UPDATE.
Tested on stock firmware MR80X(EU)_V2.20_1.1.7 Build 20250415
(Multi-language).
The U-Boot web recovery does not accept this image: it verifies an
RSA1024 signature and has no keyless path. Use the stock web UI.
Signed-off-by: Johan Alvarado <contact@c127.dev>
Link: https://github.com/openwrt/openwrt/pull/24919
Signed-off-by: Robert Marko <robimarko@gmail.com>
b0911074d3cf plat: update closed-source object for AN7581 and AN7583
705478c3d84f plat: add DRAM calibration closed-source object for EN7523
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The BPi-R4 Pro 4E is a Wi-Fi 7 router board based on the MT7988A SoC.
Difference to 8X is that board has only 4GB RAM and does not contain
the Aeonsemi 10G phys.
Wan port uses MT7988 internal 2.5GBit/s phy with no ethmux chip between
so it need overlays to switch between this wan-phy and SFP-Slot.
Specification
-------------
- SoC: Mediatek MT7988A (4x Cortex-A73 @1.8GHz)
- RAM: 4GB DDR4
- Flash: 256MB SPI-NAND, 8GB eMMC, microSD Slot
- Switch: MT7988A built-in switch, MxL86252C
- Ports: 9 ports, 8 usable simultaneously
* 2x 1G RJ45 LAN
* 4x 2.5G RJ45 LAN
* 1x SFP (LAN)
* 1x 2.5G RJ45/SFP Combo (WAN)
- Buttons: Reset, WPS
- LEDs: Power
- USB: On-board VIA VL822 USB3.2/USB2.0 hub
* 1x USB-A 2.0 connector
* 1x USB-A 3.2 connector
* 3x NGFF-KEYB
- PCIe:
* 2x mini-PCIe slots with PCIe 3.0 2-lane interface
* 2x M.2 M-Key slots with PCIe 3.0 1-lane interface (switchable
PCIe signal with M.2 B-Key)
- Debug: USB Type-C console port
- Power: USB Type-C PD 20V or DC barrel connector
Note: This device comes without a MAC address programmed from the
factory. The randomly generated MAC is stored in the U-Boot env on first
boot and used persistently afterwards.
Installation
------------
Uncompress *sdcard.img.gz and write to microSD card, eg. using 'dd'. Use
bootloader menu on the serial console to install SPI-NAND once installed
to SPI-NAND you can used the bootloader menu to install to eMMC. See
instructions for BananaPi R4 for details.
Description is taken from 8X patch and changed to 4E variant.
R4Pro needed a patch for adding aliases to ensure right probe order so add
this here too.
Co-authored-by: Wilfried Teiken <wteiken@teiken.org>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
The BPi R4 Pro 4E can boot from microSD, SPI-NAND and eMMC. Add support
for each storage option.
NVME (via pcie3) works in uboot, but bootloader only supports spi and mmc.
Patches are taken from R4Pro 8X and modified for 4E variant.
Co-authored-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Add a new Trusted Firmware-A (TF-A) build profile for the MediaTek
MT7986 SoC named 'mt7986-spim-nand-ubi-1m-ddr4'.
This profile reduces the UBI starting address (UBI_START_ADDR) from
0x200000 (2MB) down to 0x100000 (1MB). This layout adjustment matches
devices like the ASUS RT-AX59U factory partition offsets and frees up
flash space for the main operating system layout.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25278
Signed-off-by: Robert Marko <robimarko@gmail.com>
Refactor how OVERRIDE_UBI_START_ADDR is passed to the TF-A build system.
Instead of using hardcoded string matches against the $(PLAT) variable
inside global make flags, move the UBI start address directly into
target-specific definition blocks using a new UBI_START_ADDR variable.
This aligns the UBI partition boundary setup with how FIP_OFFSET and
FIP_SIZE are cleanly tracked across different MediaTek SoCs.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25278
Signed-off-by: Robert Marko <robimarko@gmail.com>
GL.iNet GL-X2000 (Spitz Plus) is a dual-SIM 4G LTE Wi-Fi 6 router.
Specifications:
SoC: Qualcomm IPQ5018, dual-core Cortex-A53 @ 1.0 GHz
RAM: 512 MiB DDR3
Flash: 128 MiB SPI NAND (Winbond W25N01GWZEIG)
WLAN: IPQ5018 2x2 2.4 GHz, QCN6122 2x2 5 GHz (802.11ax)
Ethernet: 1x GbE WAN (IPQ5018 internal GE PHY)
1x GbE LAN (Atheros AR8031, SGMII)
WWAN: Quectel EG120K-EA, LTE Cat.12, USB 3.0 SuperSpeed
USB: 1x USB 2.0 host behind an internal hub
Buttons: reset
LEDs: power, internet, 2.4G, 5G, 4x signal strength
Serial: 3v3 TTL, 115200 8N1; 4-pin header labelled GND/RX/TX/3V3 on
the mainboard, under the Quectel module in the top right
corner. The case opens after pulling the four rubber feet
Power: DC 9-35 V, shipped with a 12 V 2.5 A supply
Misc: PWM fan, dual SIM slots (muxed inside the modem)
The base MAC address is stored at offset 0x6 of the 0:art partition; the
first six bytes are erased, which is why U-Boot reports the ART address as
invalid. WAN uses the base address (this is the one on the label), LAN
base+1, the 2.4 GHz radio base+2 and the 5 GHz radio base+3. The ethernet
addresses come from nvmem cells. The board deliberately has no ethernetN
aliases: GL.iNet's U-Boot uses them to write its own mac-address
properties into both GMAC nodes (a placeholder for WAN, the base address
for LAN), which of_get_mac_address() would prefer over the nvmem cells.
The modem enumerates at SuperSpeed and therefore requires the IPQ5018 USB3
UNIPHY, so both usbphy0 and usbphy1 are enabled. uqmi cannot communicate
with this modem, so modemmanager has to be installed separately to use it.
The QCN6122 is wired to the second radio instance, so wifi@b00b040 with
userpd3 is enabled rather than wifi@b00a040: the stock device tree enables
wifi2@/userpd3 and leaves wifi1@/userpd2 disabled. That instance places
its BDF and M3 dump above the default q6 region, so the reserved region
is grown accordingly.
Board data for the two radios is submitted separately to
firmware_qca-wireless. It is taken from the stock firmware's wifi_fw
partition, which is a squashfs image: bdwlan.b24 for the IPQ5018 2.4 GHz
radio and qcn6122/bdwlan.b60 for the QCN6122 5 GHz radio, matching the
qcom,board_id values of 0x24 and 0x60 that the stock device tree assigns
to the respective radios. The two radios require distinct board data;
sharing a single BDF leaves the front-end misconfigured and the affected
radio unable to transmit or receive at usable power.
The device tree started from the initial port by Hostle, was largely
rewritten by georgem83 and further reworked by Andreas Boeckler, published
in the OpenWrt forum thread linked below. It is carried here with fixes for
the WLAN board data, the QCN6122 radio instance, the U-Boot environment
partition and the fan cooling map.
Link: https://forum.openwrt.org/t/plain-openwrt-on-gl-x2000/231554
Installation:
Interrupt the bootloader over serial (115200 8N1) by typing "gl", then
TFTP the initramfs image and boot it:
tftpboot 0x44000000 openwrt-qualcommax-ipq50xx-glinet_gl-x2000-initramfs-uImage.itb
bootm 0x44000000
Then flash the factory image with sysupgrade.
Signed-off-by: Gilberto Conde <gilbertorconde@gmail.com>
Two real commits since the previous pin:
mediatek: mt7622: move PMIC init before PLL/DRAM stage
Fixes a hang in DRAM calibration on reboot when cpufreq had lowered
Vcore before the reset, by moving PMIC init earlier so it no longer
depends on the Vcore level left over from the previous boot.
mediatek: mt7981, mt7986, mt7987, mt7988: add SMCCC TRNG support
Implements the standard SMCCC TRNG interface (upstream U-Boot
doesn't support the MTK-specific one, our uboot-mediatek does).
Tested on MT7981 by upstream; not yet verified on the other three
SoCs by upstream.
Mirror hash verified via an independent fresh clone of the pinned
commit.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Map the existing 256 KiB u_env eMMC partition for the Linksys LN6001.
This lets the device upgrade path read and update the existing boot-slot
environment through fw_printenv and fw_setenv.
Increment the package release for the functional board-map addition.
Signed-off-by: Satoshi Ikeuchi <satosan.ikm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24736
Signed-off-by: Robert Marko <robimarko@gmail.com>
The stock bootloader stays in place, so U-Boot is packaged as the
payload it accepts as a kernel and chainloaded from it.
It brings up NAND through NMBM, reads the kernel FIT from flash and
applies the device tree overlay matching the media present in the combo
port, so a single image serves both the copper PHY and the SFP cage. The
media is sensed on pio 23, the cage's mod-def0, which a seated module
pulls low. The environment tests it with "if gpio input 23", and that
reads as true for a low pin: gpio input returns the pin level as its
exit status.
The SPI-NAND is driven four-bit. The stock loader, shipped in the vendor
SDK as target/linux/mt7981/KN-1012/boot.bin, embeds an FDT whose
spi_nand@0 reads
spi-max-frequency = <0x3197500>;
spi-rx-bus-width = <0x04>;
spi-tx-bus-width = <0x04>;
on the same spi@1100a000 declaring support_quad, tick_dly = <2> and
sample_sel = <0>; MediaTek's own mt7981-rfb device tree carries the
identical pair at the identical 52 MHz. Without the two properties
spi-uclass defaults the slave to one lane and the SPI-NAND core silently
picks the single-bit read variant. The tx width also selects the
four-lane program op, which this build reaches only when NMBM has to
create its management table; the stock loader programs this part
four-bit already.
The same build serves the Keenetic and the Netcraze variant of the
board. The board support commits add a device profile for each brand,
and the two profiles produce differently named images, so the TFTP
recovery loop asks for each name in turn: the board has no populated
console to correct the name from. A single brand-neutral name was
rejected because it would match no built artifact, which breaks the
default tftpboot for both variants rather than for one. The U-Boot
device tree names the board Keenetic KN-1012 for both: the hardware is
the same and the build does not read the brand from flash.
The Kconfig entries the build relies on come as separate patches, and
both stay local: the NMBM symbols belong to the NMBM code this tree
carries, and a MediaTek bool that selects the kernel image header, with
the generic text offset base redeclared under it so the defconfig can
set it, was declined upstream. U-Boot wants a board there instead, and
this board cannot load its OS from upstream U-Boot without NMBM.
The kernel image header carries a text_offset of 0x80000: the stock
kernel FIT loads at 0x48080000, 0x80000 above the 2 MiB base the loader
works from, and the chainloader mirrors that placement. A zero offset,
which TEXT_BASE alone would give, has not been tried on this loader.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24820
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
The chip ships on Keenetic KN-1012 units and is not in the fmsh table,
so U-Boot finds no flash at all. Add the ID and geometry, along with the
ECC status decode its 3-bit status field needs and a read-cache list
whose quad-I/O read takes a single dummy byte.
The driver change is ported from Linux commits d5a5c9eb2ee9 ("mtd:
spinand: fmsh: add support for FM25G{01,02}B") and 8211f2d74b35 ("mtd:
spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles").
Only the FM25G02B entry is carried, the part in hand; the identifiers
keep upstream's FM25G01B names so that the file stays textually in step
with Linux.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24820
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Add support for the CMCC RAX3000Q/QY platform based on Qualcomm IPQ5000.
Both hardware variants are identical and share the same device tree.
Hardware Specifications:
- SoC: Qualcomm IPQ5000
- RAM: 256 MiB, integrated in SoC
- Flash: GigaDevice GD5F1GQ5REYIG (Dosilicon variant is not supported)
- 2.4 GHz Wi-Fi: SoC integrated, with 2 FEMs
- 5 GHz Wi-Fi: QCN6102, with 2 FEMs
- Switch: QCA8337, 1 WAN + 3 LAN
- LEDs: 3 RGB LEDs
- Keys: reset and mesh pairing
- UART: 3-pin, 115200n8
The vendor flash layout is documented and the ART partition contains
calibration data, which must be preserved carefully.
Due to the limited 256 MiB RAM, ath11k is disabled in the DTS to avoid
OOM issues on this device.
The MAC address location in flash could not be identified reliably.
As a temporary workaround, the MAC addresses (WAN LAN 2.4G 5G WiFi) are derived from the ART
partition start, with vendor/default values being invalid and falling
back to random generation if left unchanged (FF).
Flash Guide
Requirements
- UART access (3-pin, 115200n8)
- Ethernet cable
- TFTP server running on your computer
- OpenWrt `.ubi` firmware image
Step 0: Backup all partitions (strongly recommended)
Step 1: Connect UART and interrupt U-Boot
Step 2: Configure PC network
Step 3: Start TFTP server
Step 4: Load firmware via U-Boot
tftpboot 192.168.10.19:<your_firmware>.ubi
Step 5: Flash firmware
flash rootfs
Step 6: Reboot device
reset
Signed-off-by: Mark Jia <mark304188@hotmail.com>
TP-Link EAP650-Outdoor is a 802.11ax AP claiming AX3000 support. It is
wall or pole mountable, and rated for outdoor use. It can only be
powered via PoE.
Specifications:
---------------
* CPU: Qualcomm IPQ5018 Dual core Cortex-A53
* RAM: 512 MB
* Storage: 128MB NAND GigaDevice F50D1G41LB-83YIG2M
* Ethernet: 1x Gigabit RJ45 port with PoE input
* 2.4GHz: IPQ5018 802.11b/g/n/ax (2x 4dBi)
* 5GHz: QCN6024 802.11n/ac/ax (2x 5dBi)
* LEDs: 1x Status LED (Green/Yellow)
* Buttons: 1x Reset
* UART: 4-pin unpopulated header
TX RX GND VCC - JP2 (3.3V, 115200/8)
MAC addresses:
LAN : B0:19:21:xx:xx:02
2.4GHz : B0:19:21:xx:xx:02
5GHz : B0:19:21:xx:xx:03
The procedures to 'backup your stock firmware' and 'stock firmware recovery'
described in the commit "qualcommax: ipq50xx: Add support for Yuncore AX850"
are equivalent for this device.
https://git.openwrt.org/openwrt/openwrt/commit/?id=5d2994a73e20ba840d3096e1ad52add6937fe86d
Installation:
=============
TFTP method
-----------
To flash via tftp, first place the initramfs image on the TFTP server.
setenv serverip <ip of tftp server>
setenv ipaddr <ip in same subnet as tftp server>
tftpboot tplink_eap650-outdoor-v1-initramfs-uImage.itb
bootm
This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the commandline.
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/23056
Signed-off-by: Robert Marko <robimarko@gmail.com>
Increase the spi-max-frequency from 20MHz to 52MHz for the SPI-NAND flash
on the Mercusys MR90X v1. The underlying GigaDevice GD5F1GQ5UEYIGY
SPI-NAND flash chip natively supports clock speeds up to 133MHz and the
MediaTek MT7986B SoC handles 52MHz safely.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25246
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The APEX boot loader embeds the time of the build in its version
banner, which makes the Iomega NAS100D factory image differ between
builds:
-compiled for OpenWrt NAS100D/BE on 2026.Sep.23-04:17:21
+compiled for OpenWrt NAS100D/BE on 2026.Sep.23-11:06:03
APEX sets BUILDDATE with $(shell date) in its top level Makefile. Pass
BUILDDATE on the command line, formatted from SOURCE_DATE_EPOCH in UTC
and the C locale, which overrides it for all sub-makes.
Link: https://github.com/openwrt/openwrt/pull/25354
Signed-off-by: Paul Spooren <mail@aparcar.org>
Use mainline U-Boot with pending patches for LAN969x instead of the
old vendor U-Boot.
Both existing boards are supported.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Currently, we depend on building the host Ruby support just for the two
FWU scripts that are written in Ruby.
Use Codex 5.6 to convert the scripts to Python and drop Ruby dependency.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
u-boot 2013.10 builds timestamp_autogenerated.h with a bare date call, so
U_BOOT_DATE and U_BOOT_TIME hold the wall clock and the banner of every
image changes on each build:
U-Boot 2013.10-openwrt4 (Sep 21 2026 - 20:47:50) ARV7506PW11
Add a patch that uses SOURCE_DATE_EPOCH when the environment provides it,
which the build already exports, and keeps the wall clock otherwise. Later
u-boot versions do the same in their own timestamp rule, which is why only
this package needs the change.
Found with two lantiq/xway trees whose directory names differ in length.
Three bytes of u-boot.bin differed, all inside the banner. After the
change the three u-boot images of arv7506pw11 are identical in both trees
and the banner follows the source date.
Signed-off-by: John Crispin <john@phrozen.org>
mtk_image_set_mt7621_header() reads the wall clock and writes it to the
timestamp of the legacy image header, so the MT7621 boot loader image
differs on every build.
Add a patch that uses imagetool_get_source_date(), which the other image
tools already use, and keep the wall clock as the fallback.
Signed-off-by: John Crispin <john@phrozen.org>
mkimage -T mxsimage builds u-boot.sb. sb_get_timestamp() reads the wall
clock and sb_prefill_image_header() writes it to the boot image header.
The header digest covers that field, so the sdcard images of mxs differ on
every build.
Add a patch that uses imagetool_get_source_date(), which the other image
tools already use, and keep the wall clock as the fallback.
Tested with the mxsimage configuration of u-boot. Two images are identical
with the same SOURCE_DATE_EPOCH, differ with different values, and still
differ when the variable is not set.
Signed-off-by: John Crispin <john@phrozen.org>
Steve Meek
Yalei Zang
Andrii Kuiukoff
Alan Gao
Joe Aear
Robert Marko
Stefan Kalscheuer
Ryan Leung
Shiji Yang
Fil Dunsky
Paul Spooren
Daniel Golle
Rustam Adilov
Eduard Hart
Robert Marko
Johan Alvarado
Christian Marangi
Frank WunderlichandWilfried Teiken
Mikhail Zhilkin
Gilberto Conde
Tomasz Maciej Nowak
Satoshi Ikeuchi
Aleksei Sviridkin
Mark Jia
Samuele Longhi
Chukun Pan
John Crispin