0008-ipq40xx-add-support-for-the-ZyXEL-NBG6617.patch

From: Christian Lamparter <chunkeey@googlemail.com>
Date: Thu, 21 Jun 2018 14:24:59 +0200
Subject: ipq40xx: add support for the ZyXEL NBG6617

This patch adds support for ZyXEL NBG6617

Hardware highlights:

SOC:    IPQ4018 / QCA Dakota
CPU:    Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM:   256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR:    32 MiB Macronix MX25L25635F
ETH:    Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB:    1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1:  Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2:  Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT:  RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS:   Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS

Serial:
	WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
	The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
	pre-soldered. Pinout:
	  1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX

first install / debricking / restore stock:
 0. Have a PC running a tftp-server @ 192.168.1.99/24
 1. connect the PC to any LAN-Ports
 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
    into the tftp-server root directory and rename it to just "ras.bin".
 3. power-cycle the router and hold down the the WPS button (for 30sek)
 4. Wait (for a long time - the serial console provides some progress
    reports. The u-boot says it best: "Please be patient".
 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
    flashes fast at the same time. You have to reboot the device and
    it should then come right up.

Installation via Web-UI:
 0. Connect a PC to the powered-on router. It will assign your PC a
    IP-address via DHCP
 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
 2. Go to the "Expert Mode"
 3. Under "Maintenance", select "Firmware-Upgrade"
 4. Upload the OpenWRT factory image
 5. Wait for the Device to finish.
    It will reboot into OpenWRT without any additional actions needed.

To open the ZyXEL NBG6617:
 0. remove the four rubber feet glued on the backside
 1. remove the four philips screws and pry open the top cover
    (by applying force between the plastic top housing from the
    backside/lan-port side)

Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|   Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

|NBG6617> HELP
|ATEN    x[,y]     set BootExtension Debug Flag (y=password)
|ATSE    x         show the seed of password generator
|ATSH              dump manufacturer related data in ROM
|ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO              boot up whole system
|ATUR    x         upgrade RAS image (filename)
|NBG6617>

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

|NBG6617> ATSE NBG6617
|012345678901

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711

copy and paste the result into the shell to unlock zloader.

|NBG6617> ATEN 1,0046B0017430

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

|NBG6617> ATGU
|NBG6617#

Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>

diff --git a/include/image-commands.mk b/include/image-commands.mk
index 4d3f025b123f44cfd48d5b6cf081ae7633577277..28b39c310e499caea4fe8a6d9ad6dceb5d95363b 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -49,6 +49,19 @@ define Build/eva-image
 	mv $@.new $@
 endef
 
+define Build/make-ras
+	let \
+		newsize="$(subst k,* 1024,$(RAS_ROOTFS_SIZE))"; \
+		$(TOPDIR)/scripts/make-ras.sh \
+			--board $(RAS_BOARD) \
+			--version $(RAS_VERSION) \
+			--kernel $(call param_get_default,kernel,$(1),$(IMAGE_KERNEL)) \
+			--rootfs $@ \
+			--rootfssize $$newsize \
+			$@.new
+	@mv $@.new $@
+endef
+
 define Build/netgear-chk
 	$(STAGING_DIR_HOST)/bin/mkchkimg \
 		-o $@.new \
diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
index d475e566299416176af3b8646a7510cd3c9787e7..8cd4799b295fd38c9e846af5769c9fa9f5490f8b 100644
--- a/package/boot/uboot-envtools/files/ipq40xx
+++ b/package/boot/uboot-envtools/files/ipq40xx
@@ -35,6 +35,9 @@ openmesh,a42 |\
 openmesh,a62)
 	ubootenv_add_uci_config "/dev/mtd5" "0x0" "0x10000" "0x10000"
 	;;
+zyxel,nbg6617)
+	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
+	;;
 esac
 
 config_load ubootenv
diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
index 1cfcc33de3af58e9773d22cdcbe0c95f1633e2d9..b1428f173ddb507f0c92313dcca7aae57284a0b8 100644
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -14,7 +14,7 @@ define Build/Compile
 endef
 
 #ALLWIFIBOARDS:=<devicename>
-ALLWIFIBOARDS:=zyxel_wre6606
+ALLWIFIBOARDS:=zyxel_nbg6617 zyxel_wre6606
 ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
 
 define Package/ipq-wifi-default
@@ -50,5 +50,6 @@ endef
 
 $(eval $(call generate-ipq-wifi-package,zyxel_wre6606,board-zyxel_wre6606.bin,ZyXEL WRE6606))
 #$(eval $(call generate-ipq-wifi-package,<devicename>,<filename>,<displayname>))
+$(eval $(call generate-ipq-wifi-package,zyxel_nbg6617,board-zyxel_nbg6617.bin,ZyXEL NBG6617))
 
 $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
diff --git a/package/firmware/ipq-wifi/board-zyxel_nbg6617.bin b/package/firmware/ipq-wifi/board-zyxel_nbg6617.bin
new file mode 100644
index 0000000000000000000000000000000000000000..ab4d43e8cbc949c06f74e332807b8d92239a7de0
GIT binary patch
literal 24276
zcmeHPdr(tX8b3f3b+K|ohzNKIAwYr<AW#hwc}5x_1xpnPun5!#NsaO_AcQX1@j)RX
z0<}O0pk+`VO%WN3FR)r$JEP40xwC(?JNxL)th07UyVK6>F7CNWZXS>;2@eZ$zi`g^
z&f`1hJHLB!bMHMr?mLO`A@RFK;bEyE3F+|}LLisR0hFvzEC#?IhC)Tzj)J1X;6k}H
z<h>$kafo#Pjxb%W@MuBlek>cl71}w#whU;;2(38j-~gOzsF9giA3;4Z$_HSbvnx~p
zfbkm<I?Z~-;V`kT0Emc)`03d*2LWw0_~kF>V)5Wavu<ZY>D}pVn)D-q7f`0x5$896
z6O4EeFQmY^=s$Q{%tu@|rLlAO*whKs))~iT0R6|J8fIuz^O9Jav$ON6RjZuL1b{ns
z%+wurXCCM<ZywA?vqj$k#g=x<p-pk)5VmX#V(Ibtkh-DrKz3>}fBc%drBa@~J2_!|
zKz*jZRQgWx*6~58l}R&_-~0v2gKs#2VEi+6ePv;GGOQd{H&sfrcO}P+_hZdq86O%n
z)K_GSlcRM84+De1_*L~;IKtb>QRAOO1DVdC4|Y<Noyup!?wTu$vorW%27^FL|7OWm
zLYbwBWi@GFiHG&v>wuE=nJur<-iCsTr~`qS-l_LmN^6qj+<oo|cLqw@lg_Y9J@VTJ
zbK0ZMFv{Et`sxc5QH25TZce`4bfkKxG&sjS=Ij2-PtwnD%QnAvbFiZQ?S_yF?}MXf
zi;l+};AA3Ew_rP=jGN;YbGc92CaT|3;Z=0wv-0lH8lPgf{N;rb=`D`HD(AJoS-$~s
zbKkhhYcqbrH%qZ|?8^l9122fM$kEZ!0gIiS;Lq}EgE)`16^j@TKiI`XSu8*J=g;)@
z^<(-nnVFO|z;K0v`$DFRk3d#dMjDgp0|)x~=Vw1oO<`9+e2%}LzU;q0{_zL%GOXcd
z7iUKb<$ti<26(_s_RpU`eWGu>*j^V8!Rrw?NO4W$5EiiUA`QZW62=V<VzZZ~W(^wz
zMUZ$j9tlUokzz$v&B>1%TiRwSfQ?B|P|$!;5g6pQQSmfLhf$%TR4(-q74bwpxt?NI
z)D`hS6VL>1!lMKv1x?|mh~v;WM1=BC9+&rshipf;bGM7b&@hCL8lBKwvaSLaD@-r!
zEAv-%vx5^13h1-0;?ooej5A(D)!QhYM$MZ*r5UBwsL{+->phsYbwk~rx*=Yu7uQRi
zh$cQwL{iaIZmKu}jd&V?M5EE%XmM3dRSmv0^aq5=4Cq6<ULNaE(*s5r>)g}N%@FHc
z)6c*VV{5ngBh8R`@Smrc{j^wBt$knSTJ}0zlah0=<>-?rkth)$KrRgeU@VGPBuW+t
zkQovI5&;qc5&;qc5`h(rz((Fi#E1G8?=2*qx{bFDiKVW=1!NR9UmCe@9_#M4?T%)S
zu@;vF8)F3@LUQVMBJg~M*xA8iHMez#z}9w)<>w;xE6y!ajXnkdrpHx1qmQSj@KG%G
z>^p$PT;dw`)L8H7($tnHev7oM7OdMifB?52IJE$Tg8<0S34m-M79>G2VZhQRYB*pr
zy}g;!q!pIWEM+otTUbC4>;Qf`3P7tf;t&@J0DBDr1VBK^UyT4qcgJ<PFm-j+Z8|R4
zJjjlg9s)0hU1*M!{cr~Y?k+o0)_elxA{5-yF(~sX6KBDbYtQJnL}_4vKkL^F`kg!d
zUY&k-PP}V(R&M_OB2`msTW3%2m7(F$u{&Qr`1Y~=6@bl|DcDZj7W*sgzWOCL@G!`<
z(*=`BSYg;uqx%}gU<-8npkitrz7wk30~IIK;k%%^{ZBEk4&MQ_A4Eb6FcVu2M~Ch*
zs~|p7%d3WP`Min>!X;{dg)Mu=X_<M48!vSAX|GRwL!@uU7NcIa%tv3SRRGBg9svd+
z(&=<M4f}4hpb+V_DH`I9dUL(SG$5Q3B4Sj`6^n%+aw-xLpaQNy9BJkL8bvWEULM;r
zQ%_HfsG*PPbjWssewt!KIggH@)FfUKl1AOi+ls_cvpcZQ%>MD;IXqo1w>b9l>$h3(
z>yPjp93Z*=c$1Fp?cM_^NBNMa?W{)unT=mBvEbK(1?1OX!;b@=&Xr$}+24QU0)!6w
z58fZnuSek|O`_+yJFj+HMKLnn0l5CcUfR74{Cd-%P+I_AKRmqwEZ_pav;YgZ*qL7s
z1vi~*$|N+5qxH~!PrK{RpzosB(uYl65?WYR3>w6;lqhFOeIaT!d-;mowk0P$`@#TV
z38G|++hiLO0TKZcf#r&Ti63u`U;m$f{Pj=YfBy$KIX&kd<JZ6V=imSQ<jLP)84<r;
zAczdp^Yf>s{{63o=iHP0dhEUp-U1HbcVV}Uijh`tR7ifk5gj|Z_|_@$)=Le~Mqtuv
zU7gj;mS-ieAHQClg+0{1^VsqZ!<3uty!ze9M60G;nJEeV?#6^#Q?1OC@F%WoE+|VR
zNqql_5pAzZDU<NMvHuCXeK(K|ph1g9q1+?kP7Z6&tB%StBz*0trbi}|r166%zR)x)
z<&p$G12edDFE9}3n#q)z%FM}|+D?^1_O4``_NMBBtW+fA^PoYC@-S{NelL&%CU0xI
zROPVWHz$U*pQ@^55{W=Np;F6^iFUF*bR)bk%h9_uaSysQc|)t#oKVSSJ14GcFKOzb
zahmp)s$Ett60yA|#xx)6T=KzOx_h6^0dT6_+H)F(Dj&L}(VSA1C?(pfnr@j~6weQx
zyrsRQs+8^Jd+H510oWXxHC3vE$~0Knr8+L#B?*O&v?~>oR6b|&y0$}ADoYo!FoQ4e
zaUe?9CfYS+sywA|atv0MDRX5h(9Mew%Q!v?YdbX+vP97)oxuY*2YX}*Uh0!B*>V6$
zlt`2a5O^Jy2Eo+G;uVWP+sKj2v8^F>Uga0Hzf}v*1y*l5a_mCVNluApp-a-;-UDZM
zDE$s?lw2G+b~&LXw9ZR0GJH^za(>J2ypEph$!rX-V#qe6ecgY!Ij+`Uz9~;Nyr-Lg
z-lv)>tLx9}<ef$p)WWeVB^Tm8<djnP+#is(#Mb&9_Q<Oq+|w0O=UM(n!N73Er*Vz!
z>WxJzb=s-$WA1y`@4V4p*u1@l@xFV`S2vUc>FU4}bh-Ab;!<=yvz)rGzCHbPWVwgL
zMRaX&-^ct9edO+WeOhU^@Ek*d<o6GjX#}U3C9aau?$XA@>R>rN<KgEi4Z)S04!Z8`
zA3oHR)Xb`)9c&vo(iK}DaGX|fxm{WpqX;_WmfCmaXh-x(zfxLWM}I+ke1mTpHLtZ#
z+95dYSLT*`wsG$VkuqiuHEv{}tTXK_yTaqZid{J5#7P8R0|e&#whj2sE0b8k!}PWd
ze}5MIgKyek`1$%WeKWz5dE3TJ?mJGeUt?u&9)A#HUpjLPoL;|n!N#xxKUqW~U=@KG
z^!n%1n%PS3Sm<`s+*oN@l3x%1ci>ep@=1RE9KTv7UVSfoyClm6hBp9+gM9mSy_{NI
z_{x;(IP#7Z14kY>2q8Z|D2i3$N(l$fwd)v`fx?)hQ>57|Kmg;vQy~96tL@5z#o)g$
z_7sSC^?3QO$*sr6Ci(SdEPFy8v|;m&<k#z%`xsAn%K~!v?Ypa4x~&P9&#R~)T%z_@
o*s^C##HlwgpAV<r+;*XkI1#7byqt(rZ(dIF>lgc1^X2{jAHkef%K!iX

literal 0
HcmV?d00001

diff --git a/scripts/make-ras.sh b/scripts/make-ras.sh
new file mode 100755
index 0000000000000000000000000000000000000000..ccddaa0016b0c926d4737abb5757e7212b0a1157
--- /dev/null
+++ b/scripts/make-ras.sh
@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+#
+# --- ZyXEL header format ---
+# Original Version by Benjamin Berg <benjamin@sipsolutions.net>
+#
+# The firmware image prefixed with a header (which is written into the MTD device).
+# The header is one erase block (~64KiB) in size, but the checksum only convers the
+# first 2KiB. Padding is 0xff. All integers are in big-endian.
+#
+# The checksum is always a 16-Bit System V checksum (sum -s) stored in a 32-Bit integer.
+#
+#   4 bytes:  checksum of the rootfs image
+#   4 bytes:  length of the contained rootfs image file (big endian)
+#  32 bytes:  Firmware Version string (NUL terminated, 0xff padded)
+#   4 bytes:  checksum over the header partition (big endian - see below)
+#  32 bytes:  Model (e.g. "NBG6617", NUL termiated, 0xff padded)
+#   4 bytes:  checksum of the kernel partition
+#   4 bytes:  length of the contained kernel image file (big endian)
+#      rest: 0xff padding
+#
+# The checksums are calculated by adding up all bytes and if a 16bit
+# overflow occurs, one is added and the sum is masked to 16 bit:
+#   csum = csum + databyte; if (csum > 0xffff) { csum += 1; csum &= 0xffff };
+# Should the file have an odd number of bytes then the byte len-0x800 is
+# used additionally.
+#
+# The checksum for the header is calculated over the first 2048 bytes with
+# the rootfs image checksum as the placeholder during calculation.
+#
+# The header is padded with 0xff to the erase block size of the device.
+#
+board=""
+version=""
+kernel=""
+rootfs=""
+outfile=""
+err=""
+
+while [ "$1" ]; do
+	case "$1" in
+	"--board")
+		board="$2"
+		shift
+		shift
+		continue
+		;;
+	"--version")
+		version="$2"
+		shift
+		shift
+		continue
+		;;
+	"--kernel")
+		kernel="$2"
+		shift
+		shift
+		continue
+		;;
+	"--rootfs")
+		rootfs="$2"
+		shift
+		shift
+		continue
+		;;
+	"--rootfssize")
+		rootfssize="$2"
+		shift
+		shift
+		continue
+		;;
+	*)
+		if [ ! "$outfile" ]; then
+			outfile=$1
+			shift
+			continue
+		fi
+		;;
+	esac
+done
+
+if [ ! -n "$board" -o ! -n "$version" -o ! -r "$kernel" -o ! -r "$rootfs" -o ! "$rootfssize" -o ! "$outfile" ]; then
+	echo "syntax: $0 [--board ras-boardname] [--version ras-version] [--kernel kernelimage] [--rootfs rootfs] out"
+	exit 1
+fi
+
+rootfs_len=$(wc -c < "$rootfs")
+
+if [ "$rootfs_len" -lt "$rootfssize" ]; then
+	dd if=$rootfs of=$rootfs.new bs=$rootfssize conv=sync
+	mv $rootfs.new $rootfs
+fi
+
+if [ ${#version} -ge 28 ]; then
+	echo "version: '$version' is too long"
+	exit 1
+fi
+
+tmpdir="$( mktemp -d 2> /dev/null )"
+if [ -z "$tmpdir" ]; then
+	# try OSX signature
+	tmpdir="$( mktemp -t 'ubitmp' -d )"
+fi
+
+if [ -z "$tmpdir" ]; then
+	exit 1
+fi
+
+to_be() {
+	local val="$1"
+	local size="$2"
+
+	case "$size" in
+	4)
+		echo $(( "$val" >> 24 | ("$val" & 0xff0000) >> 8 | ("$val" & 0xff00) << 8 | ("$val" & 0xff) << 24 ))
+		;;
+	2)
+		echo $(( "$val" >> 8 | ("$val" & 0xff) << 8))
+		;;
+	esac
+}
+
+checksum_file() {
+	local file=$1
+
+	# ZyXEL seems to use System V sum mode... Now this is classy, who would have thought?!
+	echo $(sum -s ${file} | cut -f1 -d" ")
+}
+
+append_bin() {
+	local val=$1
+	local size=$2
+	local file=$3
+
+	while [ "$size" -ne 0 ]; do
+		printf \\$(printf %o $(("$val" & 0xff)))  >> "$file"
+		val=$(($val >> 8))
+		let size-=1
+	done
+	return
+}
+
+tf=${tmpdir}/out
+pad=$(printf '%0.1s' $(printf "\xff"){1..64})
+
+rootfs_header_file="$tmpdir/rootfs_header"
+rootfs_chksum=$(to_be $(checksum_file ${rootfs}) 4)
+rootfs_len=$(to_be $(wc -c < "$rootfs") 4)
+
+versionpadlen=$(( 32 - ( ${#version} + 1) ))
+
+# 4 bytes:  checksum of the rootfs image
+append_bin "$rootfs_chksum" 4 "$rootfs_header_file"
+# 4 bytes:  length of the contained rootfs image file (big endian)
+append_bin "$rootfs_len" 4 "$rootfs_header_file"
+# 32 bytes:  Firmware Version string (NUL terminated, 0xff padded)
+printf "%s\x00%.*s" "$version" "$versionpadlen" "$pad" >> "$rootfs_header_file"
+
+kernel_header_file="$tmpdir/kernel_header"
+kernel_chksum=$(to_be $(checksum_file ${kernel}) 4)
+kernel_len=$(to_be $(wc -c < "$kernel") 4)
+
+# 4 bytes:  checksum of the kernel image
+append_bin "$kernel_chksum" 4 "$kernel_header_file"
+# 4 bytes:  length of the contained kernel image file (big endian)
+append_bin "$kernel_len" 4 "$kernel_header_file"
+
+board_header_file="$tmpdir/board_header"
+board_file="$tmpdir/board"
+boardpadlen=$(( 64 - ( ${#board} + 1) ))
+# 32 bytes:  Model (e.g. "NBG6617", NUL termiated, 0xff padded)
+printf "%s\x00%.*s" "$board" "$boardpadlen" "$pad" > "$board_file"
+cat "$kernel_header_file" >> "$board_file"
+printf "%.12s" "$pad" >> "$board_file"
+#      rest: 0xff padding
+for i in {1..511}; do
+	printf "%s%s" "$pad" "$pad" >> "$board_file"
+done
+
+tmp_board_file="$tmpdir/tmp_board_file"
+cat "$rootfs_header_file" > "$tmp_board_file"
+
+# The checksum for the header is calculated over the first 2048 bytes with
+# the rootfs image checksum as the placeholder during calculation.
+append_bin "$rootfs_chksum" 4 "$tmp_board_file"
+cat "$board_file" >> "$tmp_board_file"
+
+truncate -s 2048 $tmp_board_file
+board_chksum=$(to_be $(checksum_file ${tmp_board_file}) 4)
+
+# 4 bytes:  checksum over the header partition (big endian)
+append_bin "$board_chksum" 4 "$board_header_file"
+cat "$board_file" >> "$board_header_file"
+
+cat "$rootfs_header_file" "$board_header_file" "$rootfs" "$kernel" > "$outfile"
+
+rm -rf "$tmpdir"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index fcba2aea543cdead03ef372bc6b751481846fbf7..475a8623f705d683a7ee3521ee71f2b57fa2e44d 100755
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -34,6 +34,11 @@ netgear,ex6150v2)
 meraki,mr33)
 	ucidef_set_interface_lan "eth0"
 	;;
+zyxel,nbg6617)
+	ucidef_set_led_wlan "wlan2g" "WLAN2G" "$board:green:wlan2G" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WLAN5G" "$board:green:wlan5G" "phy1tpt"
+	ucidef_set_led_usbport "usb" "USB" "${board}:green:usb" "usb1-port1" "usb2-port1" "usb3-port1" "usb4-port1"
+	;;
 zyxel,wre6606)
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "${boardname}:green:wlan2g" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "${boardname}:green:wlan5g" "phy1tpt"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 03e0c0e16c33f43fafcbba9c5af4baf6dd73e425..5c90ef136fd7cbbe023001030d8c9003347bd249 100755
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -48,6 +48,11 @@ netgear,ex6150v2 |\
 zyxel,wre6606)
 	ucidef_set_interface_lan "eth0"
 	;;
+zyxel,nbg6617)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	ucidef_add_switch "switch0" \
+		"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
+	;;
 *)
 	echo "Unsupported hardware. Network interfaces not intialized"
 	;;
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index d89ddf6e57ee9f759f6dcc7c7f8152c11305499b..1d4fd9cd8f9a3983ac3323ce72153c1dcc17a69a 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -146,6 +146,7 @@ case "$FIRMWARE" in
 	openmesh,a62)
 		ath10kcal_extract "0:ART" 4096 12064
 		;;
+	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		ath10kcal_extract "ART" 4096 12064
 		ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
@@ -181,6 +182,7 @@ case "$FIRMWARE" in
 	openmesh,a62)
 		ath10kcal_extract "0:ART" 20480 12064
 		;;
+	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		ath10kcal_extract "ART" 20480 12064
 		ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -1)
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
index 1acd7366c81f7c70ef9018d97a833e4d355e8119..44e81ca366dd57d3d5d7fbb9065254925e94061a 100644
--- a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -8,6 +8,10 @@ preinit_set_mac_address() {
 		mac_lan=$(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102)
 		[ -n "$mac_lan" ] && ip link set dev eth0 address "$mac_lan"
 		;;
+	zyxel,nbg6617)
+		base_mac=$(cat /sys/class/net/eth0/address)
+		ip link set dev eth0 address $(macaddr_add "$base_mac" +2)
+		ip link set dev eth1 address $(macaddr_add "$base_mac" +3)
 	esac
 }
 
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh
new file mode 100644
index 0000000000000000000000000000000000000000..578ddbe4c4f6e91d925ea3a0de9e060daac82e72
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set_preinit_iface() {
+	. /lib/functions.sh
+
+	case $(board_name) in
+	asus,rt-ac58u| \
+	avm,fritzbox-4040| \
+	glinet,gl-b1300| \
+	meraki,mr33| \
+	zyxel,nbg6617)
+		ifname=eth0
+		;;
+	*)
+		;;
+	esac
+}
+
+boot_hook_add preinit_main set_preinit_iface
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index 4096e127ea9eaa8106475a3143b0b2ea796b5c7c..0e29302465fb5fca6f2a2194c751728f492053d5 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -29,6 +29,21 @@ EOF
 	return 0;
 }
 
+zyxel_do_upgrade() {
+	local tar_file="$1"
+
+	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	tar Oxf $tar_file ${board_dir}/kernel | mtd write - kernel
+
+	if [ "$SAVE_CONFIG" -eq 1 ]; then
+		tar Oxf $tar_file ${board_dir}/root | mtd -j "$CONF_TAR" write - rootfs
+	else
+		tar Oxf $tar_file ${board_dir}/root | mtd write - rootfs
+	fi
+}
+
 platform_do_upgrade() {
 	case "$(board_name)" in
 	8dev,jalapeno)
@@ -48,6 +63,9 @@ platform_do_upgrade() {
 		CI_KERNPART="part.safe"
 		nand_do_upgrade "$1"
 		;;
+	zyxel,nbg6617)
+		zyxel_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$ARGV"
 		;;
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
new file mode 100644
index 0000000000000000000000000000000000000000..d7f8c5955caee15d373a342b75c8c1947f5b8022
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
@@ -0,0 +1,321 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "ZyXEL NBG6617";
+	compatible = "zyxel,nbg6617", "qcom,ipq4019";
+
+	chosen {
+		/*
+		 * the vendor u-boot adds root and mtdparts cmdline parameters
+		 * which we don't want... but we have to overwrite them or else
+		 * the kernel will take them at face value.
+		 */
+		bootargs-append = " mtdparts= root=31:13";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		wlan {
+			label = "wlan";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_RFKILL>;
+			linux,input-type = <EV_SW>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		power: power {
+			label = "nbg6617:green:power";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "nbg6617:green:usb";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2G {
+			label = "nbg6617:green:wlan2G";
+			gpios = <&tlmm 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5G {
+			label = "nbg6617:green:wlan5G";
+			gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "nbg6617:green:wps";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+	spi_0_pins: spi_0_pinmux {
+		mux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-low;
+		};
+	};
+	led_pins: led_pinmux  {
+		mux {
+			pins = "gpio0", "gpio1", "gpio3", "gpio5", "gpio58";
+			drive-strength = <0x8>;
+			bias-disable;
+			output-low;
+		};
+	};
+};
+
+&spi_0 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	mx25l25635f@0 {
+		compatible = "mx25l25635f", "jedec,spi-nor";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+		status = "okay";
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+			partition1@40000 {
+				label = "MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+			partition2@60000 {
+				label = "QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+			partition3@c0000 {
+				label = "CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+			partition4@d0000 {
+				label = "DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+			partition5@e0000 {
+				label = "APPSBL"; /* u-boot */
+				reg = <0x000e0000 0x00080000>;
+				/* U-Boot Standalone App "zloader" is located at 0x64000 */
+				read-only;
+			};
+			partition6@160000 {
+				label = "APPSBLENV"; /* u-boot env */
+				reg = <0x00160000 0x00010000>;
+			};
+			partition7@170000 {
+				/* make a backup of this partition! */
+				label = "ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+			};
+			partition8@180000 {
+				label = "kernel";
+				reg = <0x00180000 0x00400000>;
+			};
+			partition9@580000 {
+				label = "dualflag";
+				reg = <0x00580000 0x00010000>;
+				read-only;
+			};
+			partition10@590000 {
+				label = "header";
+				reg = <0x00590000 0x00010000>;
+			};
+			partition11@5a0000 {
+				label = "romd";
+				reg = <0x005a0000 0x00100000>;
+				read-only;
+			};
+			partition12@6a0000 {
+				label = "not_root_data";
+				/*
+				 * for some strange reason, someone at ZyXEL
+				 * had the "great" idea to put the rootfs_data
+				 * in front of rootfs... Don't do that!
+				 * As a result this one, full MebiByte remains
+				 * unused.
+				 */
+				reg = <0x006a0000 0x00100000>;
+			};
+			partition13@7a0000 {
+				label = "rootfs";
+				reg = <0x007a0000 0x01860000>;
+			};
+		};
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/image/Makefile b/target/linux/ipq40xx/image/Makefile
index 38600cf979242142aa08c30163e63d911f0ddb63..d1ee1004fddce6cf6007259229d8eee5b5b2ea3b 100644
--- a/target/linux/ipq40xx/image/Makefile
+++ b/target/linux/ipq40xx/image/Makefile
@@ -1,6 +1,8 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
+DEVICE_VARS += RAS_BOARD RAS_ROOTFS_SIZE RAS_VERSION
+
 define Device/Default
 	PROFILES := Default
 	KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
@@ -205,6 +207,26 @@ define Device/qcom_ap-dk04.1-c1
 endef
 TARGET_DEVICES += qcom_ap-dk04.1-c1
 
+define Device/zyxel_nbg6617
+	$(call Device/FitImageLzma)
+	DEVICE_DTS := qcom-ipq4018-nbg6617
+	DEVICE_TITLE := ZyXEL NBG6617
+	ROOTFS_SIZE := 24960k
+	RAS_BOARD := NBG6617
+	RAS_ROOTFS_SIZE := 19840k
+	RAS_VERSION := "$(VERSION_DIST) $(REVISION)"
+	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
+	IMAGES := sysupgrade.bin factory.bin
+#	The ZyXEL firmware allows flashing thru the web-gui only when the rootfs is
+#	at least as large as the one of the initial firmware image (not the current
+#	one on the device). This only applies to the Web-UI, the bootlaoder ignores
+#	this minimum-size. However, the larger image can be flashed both ways.
+	IMAGE/factory.bin := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | make-ras
+	IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | sysupgrade-tar rootfs=$$$$@ | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-zyxel_nbg6617 uboot-envtools
+endef
+TARGET_DEVICES += zyxel_nbg6617
+
 define Device/zyxel_wre6606
 	$(call Device/FitImage)
 	DEVICE_TITLE := ZyXEL WRE6606
diff --git a/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
index 3aa368be8381d9c48aefccbe6d4cc768b00dc41e..8066f986a4e030c9c8fe0ec4438e92d30daa77f0 100644
--- a/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
+++ b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -697,7 +697,19 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+@@ -697,7 +697,20 @@ dtb-$(CONFIG_ARCH_QCOM) += \
  	qcom-apq8074-dragonboard.dtb \
  	qcom-apq8084-ifc6540.dtb \
  	qcom-apq8084-mtp.dtb \
@@ -19,6 +19,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +	qcom-ipq4018-ex6150v2.dtb \
 +	qcom-ipq4018-fritz4040.dtb \
 +	qcom-ipq4018-jalapeno.dtb \
++	qcom-ipq4018-nbg6617.dtb \
 +	qcom-ipq4018-rt-ac58u.dtb \
 +	qcom-ipq4018-wre6606.dtb \
  	qcom-ipq4019-ap.dk01.1-c1.dtb \
diff --git a/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch b/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7c513a6ad8ec817bf388c67e1181f08982888fa5
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch
@@ -0,0 +1,64 @@
+Index: linux-4.14.50/drivers/mtd/spi-nor/spi-nor.c
+===================================================================
+--- linux-4.14.50.orig/drivers/mtd/spi-nor/spi-nor.c
++++ linux-4.14.50/drivers/mtd/spi-nor/spi-nor.c
+@@ -1025,6 +1025,7 @@ static const struct flash_info spi_nor_i
+ 	{ "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
+ 	{ "mx25l12855e", INFO(0xc22618, 0, 64 * 1024, 256, 0) },
+ 	{ "mx25l25635e", INFO(0xc22019, 0, 64 * 1024, 512, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
++	{ "mx25l25635f", INFO(0xc22019, 0, 64 * 1024, 512, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | SPI_NOR_4B_OPCODES) },
+ 	{ "mx25u25635f", INFO(0xc22539, 0, 64 * 1024, 512, SECT_4K | SPI_NOR_4B_OPCODES) },
+ 	{ "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) },
+ 	{ "mx66l51235l", INFO(0xc2201a, 0, 64 * 1024, 1024, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+@@ -1189,11 +1190,12 @@ static const struct flash_info spi_nor_i
+ 	{ },
+ };
+ 
+-static const struct flash_info *spi_nor_read_id(struct spi_nor *nor)
++static const struct flash_info *spi_nor_read_id(struct spi_nor *nor,
++						const char *name)
+ {
+ 	int			tmp;
+ 	u8			id[SPI_NOR_MAX_ID_LEN];
+-	const struct flash_info	*info;
++	const struct flash_info	*info, *first_match = NULL;
+ 
+ 	tmp = nor->read_reg(nor, SPINOR_OP_RDID, id, SPI_NOR_MAX_ID_LEN);
+ 	if (tmp < 0) {
+@@ -1204,10 +1206,16 @@ static const struct flash_info *spi_nor_
+ 	for (tmp = 0; tmp < ARRAY_SIZE(spi_nor_ids) - 1; tmp++) {
+ 		info = &spi_nor_ids[tmp];
+ 		if (info->id_len) {
+-			if (!memcmp(info->id, id, info->id_len))
+-				return &spi_nor_ids[tmp];
++			if (!memcmp(info->id, id, info->id_len)) {
++				if (!name || !strcmp(name, info->name))
++					return info;
++				if (!first_match)
++					first_match = info;
++			}
+ 		}
+ 	}