diff mbox series

[OpenWrt-Devel,3/5] ath79: add support for ZyXEL NBG6716

Message ID 20191021123214.2252-4-avalentin@marcant.net
State Changes Requested
Headers show
Series ZyXEL NBG6716 update ar71xx, add ath79, add mtd mac parser | expand

Commit Message

André Valentin Oct. 21, 2019, 12:32 p.m. UTC 
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
image:
mtd -r write openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin firmware
You will end up with a fresh config if you do not inject config into the image.

Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|   Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

|NBG6716> HELP
|ATEN    x[,y]     set BootExtension Debug Flag (y=password)
|ATSE    x         show the seed of password generator
|ATSH              dump manufacturer related data in ROM
|ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO              boot up whole system
|ATUR    x         upgrade RAS image (filename)
|NBG6716>

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

|NBG6716> ATSE NBG6716
|012345678901

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711

copy and paste the result into the shell to unlock zloader.

|NBG6716> ATEN 1,0046B0017430

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

|NBG6716> ATGU
|NBG6716#

Signed-off-by: André Valentin <avalentin@marcant.net>
---
 .../ath79/base-files/etc/board.d/02_network   |   8 +
 .../etc/hotplug.d/firmware/10-ath9k-eeprom    |   4 +
 .../etc/hotplug.d/firmware/11-ath10k-caldata  |   4 +
 .../etc/hotplug.d/ieee80211/00-wifi-migration |   1 +
 .../ath79/base-files/lib/upgrade/platform.sh  |   3 +
 target/linux/ath79/dts/qca9557.dtsi           |  18 ++
 .../linux/ath79/dts/qca9558_zyxel_nbg6716.dts | 302 ++++++++++++++++++
 target/linux/ath79/image/Makefile             |   2 +
 target/linux/ath79/image/common-zyxel.mk      |  28 ++
 target/linux/ath79/image/nand-zyxel.mk        |  20 ++
 10 files changed, 390 insertions(+)
 create mode 100644 target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
 create mode 100644 target/linux/ath79/image/common-zyxel.mk
 create mode 100644 target/linux/ath79/image/nand-zyxel.mk

Comments

Adrian Schmutzler Oct. 21, 2019, 1:15 p.m. UTC | #1 
Hi,

> -----Original Message-----
> From: openwrt-devel [mailto:openwrt-devel-bounces@lists.openwrt.org] On Behalf Of André Valentin
> Sent: Montag, 21. Oktober 2019 14:32
> To: openwrt-devel@lists.openwrt.org
> Cc: avalentin@marcant.net
> Subject: [OpenWrt-Devel] [PATCH 3/5] ath79: add support for ZyXEL NBG6716
> 
> Attention: Kernel partition size has been enlarged to 4MB.
> To switch, you must update to latest ar71xx-nand snapshort and flash the
> image:
> mtd -r write openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin firmware
> You will end up with a fresh config if you do not inject config into the image.
> 
> Access the real u-boot shell:
> ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
> When the device is starting up, the user can enter the the loader shell
> by simply pressing a key within the 3 seconds once the following string
> appears on the serial console:
> 
> |   Hit any key to stop autoboot:  3
> 
> The user is then dropped to a locked shell.
> 
> |NBG6716> HELP
> |ATEN    x[,y]     set BootExtension Debug Flag (y=password)
> |ATSE    x         show the seed of password generator
> |ATSH              dump manufacturer related data in ROM
> |ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
> |ATGO              boot up whole system
> |ATUR    x         upgrade RAS image (filename)
> |NBG6716>
> 
> In order to escape/unlock a password challenge has to be passed.
> Note: the value is dynamic! you have to calculate your own!
> 
> First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
> to get the challange value/seed.
> 
> |NBG6716> ATSE NBG6716
> |012345678901
> 
> This seed/value can be converted to the password with the help of this
> bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
> 
> - tool.sh -
> ror32() {
>   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
> }
> v="0x$1"
> a="0x${v:2:6}"
> b=$(( $a + 0x10F0A563))
> c=$(( 0x${v:12:14} & 7 ))
> p=$(( $(ror32 $b $c) ^ $a ))
> printf "ATEN 1,%X\n" $p
> - end of tool.sh -
> 
> |# bash ./tool.sh 012345678901
> |
> |ATEN 1,879C711
> 
> copy and paste the result into the shell to unlock zloader.
> 
> |NBG6716> ATEN 1,0046B0017430
> 
> If the entered code was correct the shell will change to
> use the ATGU command to enter the real u-boot shell.
> 
> |NBG6716> ATGU
> |NBG6716#
> 
> Signed-off-by: André Valentin <avalentin@marcant.net>
> ---
>  .../ath79/base-files/etc/board.d/02_network   |   8 +
>  .../etc/hotplug.d/firmware/10-ath9k-eeprom    |   4 +
>  .../etc/hotplug.d/firmware/11-ath10k-caldata  |   4 +
>  .../etc/hotplug.d/ieee80211/00-wifi-migration |   1 +
>  .../ath79/base-files/lib/upgrade/platform.sh  |   3 +
>  target/linux/ath79/dts/qca9557.dtsi           |  18 ++
>  .../linux/ath79/dts/qca9558_zyxel_nbg6716.dts | 302 ++++++++++++++++++
>  target/linux/ath79/image/Makefile             |   2 +
>  target/linux/ath79/image/common-zyxel.mk      |  28 ++
>  target/linux/ath79/image/nand-zyxel.mk        |  20 ++
>  10 files changed, 390 insertions(+)
>  create mode 100644 target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
>  create mode 100644 target/linux/ath79/image/common-zyxel.mk
>  create mode 100644 target/linux/ath79/image/nand-zyxel.mk
> 
> diff --git a/target/linux/ath79/base-files/etc/board.d/02_network b/target/linux/ath79/base-files/etc/board.d/02_network
> index fe74bddbf1..575e50c12d 100755
> --- a/target/linux/ath79/base-files/etc/board.d/02_network
> +++ b/target/linux/ath79/base-files/etc/board.d/02_network
> @@ -295,6 +295,10 @@ ath79_setup_interfaces()
>  		ucidef_add_switch "switch0" \
>  			"0@eth0" "5:lan" "1:wan"
>  		;;
> +	zyxel,nbg6716)
> +		ucidef_add_switch "switch0" \
> +			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
> +		;;

Check sorting.

>  	zbtlink,zbt-wd323|\
>  	xiaomi,mi-router-4q)
>  		ucidef_set_interface_wan "eth1"
> @@ -435,6 +439,10 @@ ath79_setup_macs()
>  	wd,mynet-wifi-rangeextender)
>  		lan_mac=$(nvram get et0macaddr)
>  		;;
> +	zyxel,nbg6716)
> +		lan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +2)
> +		wan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +3)

You already set MAC addresses in DTS, so you can remove this entire block.

> +		;;
>  	esac
> 
>  	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/base-
> files/etc/hotplug.d/firmware/10-ath9k-eeprom
> index 3240026aec..f8241541cd 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
> @@ -46,6 +46,10 @@ case "$FIRMWARE" in
>  		caldata_extract "radiocfg" 0x1000 0x440
>  		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan24mac")
>  		;;
> +	zyxel,nbg6716)
> +		ath9k_eeprom_extract "art" 0x1000 0x440
> +		ath9k_patch_fw_mac $(mtd_get_mac_ascii u-boot-env ethaddr) 0x2
> +		;;

The function names are outdated. Have you checked whether you can merge this definition?

>  	*)
>  		caldata_die "board $board is not supported yet"
>  		;;
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-
> files/etc/hotplug.d/firmware/11-ath10k-caldata
> index 8ab0f6f6ad..8b885864c6 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
> @@ -41,6 +41,10 @@ case "$FIRMWARE" in
>  		caldata_extract "art" 0x5000 0x844
>  		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
>  		;;
> +	zyxel,nbg6716)
> +		ath10kcal_extract "art" 0x5000 0x844
> +		ath10kcal_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
> +		;;

The function have been renamed. However, you can merge this with previous node.

>  	engenius,ews511ap)
>  		caldata_extract "art" 0x5000 0x844
>  		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration b/target/linux/ath79/base-
> files/etc/hotplug.d/ieee80211/00-wifi-migration
> index 37a1346fe7..637bfe9ea0 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
> @@ -14,6 +14,7 @@ migrate_wifi_path() {
>  			board=$(board_name)
> 
>  			case "$board" in
> +				zyxel,nbg6716|\

Sorting!

>  				tplink,archer-c7-v1|\
>  				tplink,archer-c7-v2)
>  					path="pci0000:00/0000:00:00.0"
> diff --git a/target/linux/ath79/base-files/lib/upgrade/platform.sh b/target/linux/ath79/base-files/lib/upgrade/platform.sh
> index f4fca06384..46bd6ab9ef 100644
> --- a/target/linux/ath79/base-files/lib/upgrade/platform.sh
> +++ b/target/linux/ath79/base-files/lib/upgrade/platform.sh
> @@ -51,6 +51,9 @@ platform_do_upgrade() {
>  	ubnt,routerstation-pro)
>  		redboot_fis_do_upgrade "$1" kernel
>  		;;
> +	zyxel,nbg6716)
> +		nand_do_upgrade "$1"
> +		;;
>  	*)
>  		default_do_upgrade "$1"
>  		;;
> diff --git a/target/linux/ath79/dts/qca9557.dtsi b/target/linux/ath79/dts/qca9557.dtsi
> index b29dfc72b2..61e1d5f6a4 100644
> --- a/target/linux/ath79/dts/qca9557.dtsi
> +++ b/target/linux/ath79/dts/qca9557.dtsi
> @@ -178,6 +178,24 @@
>  			};
>  		};
> 
> +		nand: nand@1b800200 {
> +			compatible = "qca,ar934x-nand";
> +			reg = <0x1b800200 0xb8>;
> +
> +			interrupts = <21>;
> +			interrupt-parent = <&miscintc>;
> +
> +			resets = <&rst 14>;
> +			reset-names = "nand";
> +
> +			nand-ecc-mode = "hw";
> +
> +			#address-cells = <1>;
> +			#size-cells = <0>;
> +
> +			status = "disabled";
> +		};
> +
>  		gmac: gmac@18070000 {
>  			compatible = "qca,qca9550-gmac";
>  			reg = <0x18070000 0x58>;
> diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
> new file mode 100644
> index 0000000000..677aa7aac5
> --- /dev/null
> +++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
> @@ -0,0 +1,302 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
> +/dts-v1/;
> +
> +#include <dt-bindings/gpio/gpio.h>
> +#include <dt-bindings/input/input.h>
> +
> +#include "qca9557.dtsi"
> +
> +/ {
> +	compatible = "zyxel,nbg6716", "qca,qca9558";
> +	model = "ZyXEL NBG6716";
> +
> +	chosen {
> +		bootargs = "console=ttyS0,115200n8";
> +	};
> +
> +	aliases {
> +		led-boot = &power;
> +		led-failsafe = &power;
> +		led-running = &power;
> +		led-upgrade = &power;
> +		label-mac-device = &eth0;
> +	};
> +	leds {
> +		compatible = "gpio-leds";
> +
> +		power: power {
> +			label = "nbg6716:white:power";
> +			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
> +		};
> +
> +		wan {
> +			label = "nbg6716:white:internet";
> +			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
> +		};
> +		usb1 {
> +			label = "nbg6716:white:usb1";
> +			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "usbport";
> +			trigger-sources = <&hub_port0>;
> +		};
> +		usb2 {
> +			label = "nbg6716:white:usb2";
> +			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "usbport";
> +			trigger-sources = <&hub_port1>;
> +		};
> +		wifi2 {
> +			label = "nbg6716:white:wifi2";
> +			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "phy1tpt";
> +		};
> +		wifi5 {
> +			label = "nbg6716:white:wifi5";
> +			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "phy0tpt";
> +		};
> +		wps {
> +			label = "nbg6716:white:wps";
> +			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
> +		};
> +	};
> +
> +	keys {
> +		compatible = "gpio-keys";
> +
> +		reset {
> +			label = "reset";
> +			linux,code = <KEY_RESTART>;
> +			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        wifi_button {
> +                        label = "WiFi button";
> +			linux,code = <KEY_RFKILL>;
> +			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        usb1 {
> +                        label = "USB1 eject button";
> +			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        usb2 {
> +                        label = "USB2 eject button";
> +			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +		wps {
> +			label = "WPS button";
> +			linux,code = <KEY_WPS_BUTTON>;
> +			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +	};
> +	gpio-export {
> +		compatible = "gpio-export";
> +		#size-cells = <0>;
> +
> +		gpio_usb_power {
> +			gpio-export,name = "nbg6716:power:usb";
> +			gpio-export,output = <1>;
> +			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
> +		};
> +	};
> +};
> +
> +&uart {
> +	status = "okay";
> +};
> +
> +&spi {
> +	status = "okay";
> +	num-cs = <1>;
> +
> +	flash@0 {
> +		compatible = "jedec,spi-nor";
> +		reg = <0>;
> +		spi-max-frequency = <25000000>;
> +
> +		partitions {
> +			compatible = "fixed-partitions";
> +			#address-cells = <1>;
> +			#size-cells = <1>;
> +
> +			uboot: partition@0 {
> +				label = "u-boot";
> +				reg = <0x000000 0x040000>;
> +				read-only;
> +			};
> +
> +                        partition@40000 {
> +                                label = "u-boot-env";
> +                                reg = <0x040000 0x010000>;
> +                        };
> +
> +			art: partition@50000 {
> +				label = "art";
> +				reg = <0x050000 0x010000>;
> +				read-only;
> +			};
> +
> +			partition@60000 {
> +				label = "nbu";
> +				reg = <0x060000 0xFA0000>;
> +			};
> +		};
> +	};
> +};
> +
> +&nand {
> +	status = "okay";
> +
> +	partitions {
> +		compatible = "fixed-partitions";
> +		#address-cells = <1>;
> +		#size-cells = <1>;
> +
> +		partition@0 {
> +			label = "zyxel_rfsd";
> +			reg = <0x0 0x200000>;
> +		};
> +
> +		partition@200000 {
> +			label = "romd";
> +			reg = <0x200000 0x200000>;
> +		};
> +
> +		partition@400000 {
> +			label = "header";
> +			reg = <0x400000 0x100000>;
> +		};
> +
> +		firmware@500000 {
> +			label = "firmware";
> +			reg = <0x500000 0x7B00000>;
> +		};
> +
> +		partition@500000 {
> +			label = "kernel";
> +			reg = <0x500000 0x400000>;
> +		};
> +
> +		partition@900000 {
> +			label = "ubi";
> +			reg = <0x900000 0x7700000>;
> +		};
> +	};
> +};
> +
> +&mdio0 {
> +	status = "okay";
> +
> +	phy0: ethernet-phy@0 {
> +		reg = <17>;
> +		phy-mode = "rgmii-id";
> +	};
> +
> +	switch0@1f {
> +		compatible = "qca,ar8327";
> +		reg = <0x1f>;
> +		qca,ar8327-initvals = <
> +			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
> +			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
> +			0x10 0x81000080 /* POWER_ON_STRIP */
> +			0x50 0xffb7ffb7 /* LED_CTRL0 */
> +			0x54 0xffb7ffb7 /* LED_CTRL1 */
> +			0x58 0xffb7ffb7 /* LED_CTRL2 */
> +			0x5c 0x03ffff00 /* LED_CTRL3 */
> +			0x7c 0x0000007e /* PORT0_STATUS */
> +			0x94 0x0000007e /* PORT6 STATUS */
> +			>;
> +	};
> +};
> +
> +&mdio1 {
> +	status = "okay";
> +
> +	phy1: ethernet-phy@1 {
> +		reg = <1>;
> +		phy-mode = "sgmii";
> +	};
> +};
> +
> +
> +&eth0 {
> +	status = "okay";
> +
> +	pll-data = <0xa6000000 0x00000101 0x00001616>;
> +	mtd-mac-address = <&uboot 0x5E2>;

I'd prefer lower-case for the "E".

> +	phy-handle = <&phy0>;
> +	fixed-link {
> +		speed = <1000>;
> +		full-duplex;
> +	};
> +};
> +
> +&eth1 {
> +	status = "okay";
> +
> +	pll-data = <0x03000101 0x00000101 0x00001616>;
> +	mtd-mac-address = <&uboot 0x5E2>;

I'd prefer lower-case for the "E".

> +	mtd-mac-address-increment = <1>;
> +	phy-handle = <&phy1>;
> +	fixed-link {
> +		speed = <1000>;
> +		full-duplex;
> +	};
> +};
> +
> +// This node is required for the Ethernet ports to work correctly.

Checked or copy-paste?

> +&gpio {
> +	status = "okay";
> +};
> +
> +&wmac {
> +	status = "okay";
> +	mtd-cal-data = <&art 0x1000>;
> +	mtd-mac-address = <&uboot 0x5E2>;
> +	mtd-mac-address-increment = <3>;

You almost convinced, but now I doubt:
If you set up wmac here and ath10k below, then your 10-ath9k-eeprom is bogus?
Despite, the MAC address increments in DTS and in base-files are different.

So, to sort this out correctly, please explain which addresses you find for which interface (lan, wan, 2.4 ghz, 5 ghz) on stock firmware and tell us to which <&uboot 0x5E2> and $(mtd_get_mac_ascii u-boot-env ethaddr) correspond.

After having looked at this node, it looks to me like you just distributed them randomly.

> +};
> +
> +&pcie1 {
> +        status = "okay";
> +
> +	wifi@0,0 {
> +		compatible = "qcom,ath10k";
> +		reg = <0 0 0 0 0>;
> +	};
> +};
> +
> +&usb_phy0 {
> +        status = "okay";
> +};
> +
> +&usb_phy1 {
> +        status = "okay";
> +};
> +
> +&usb0 {
> +        status = "okay";
> +
> +	hub_port0: port@1 {
> +		reg = <1>;
> +		#trigger-source-cells = <0>;
> +	};
> +
> +};
> +
> +&usb1 {
> +        status = "okay";
> +
> +	hub_port1: port@1 {
> +		reg = <1>;
> +		#trigger-source-cells = <0>;
> +	};
> +};
> +
> diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
> index 24768ef5e0..21775b4b48 100644
> --- a/target/linux/ath79/image/Makefile
> +++ b/target/linux/ath79/image/Makefile
> @@ -77,6 +77,8 @@ include ./generic-ubnt.mk
>  endif
>  ifeq ($(SUBTARGET),nand)
>  include ./nand.mk
> +include ./nand-netgear.mk

That seems unrelated. Remove it and do it separately (if it was done by intention.)

Best

Adrian
diff mbox series

Patch

diff --git a/target/linux/ath79/base-files/etc/board.d/02_network b/target/linux/ath79/base-files/etc/board.d/02_network
index fe74bddbf1..575e50c12d 100755
--- a/target/linux/ath79/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/base-files/etc/board.d/02_network
@@ -295,6 +295,10 @@  ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "5:lan" "1:wan"
 		;;
+	zyxel,nbg6716)
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
+		;;
 	zbtlink,zbt-wd323|\
 	xiaomi,mi-router-4q)
 		ucidef_set_interface_wan "eth1"
@@ -435,6 +439,10 @@  ath79_setup_macs()
 	wd,mynet-wifi-rangeextender)
 		lan_mac=$(nvram get et0macaddr)
 		;;
+	zyxel,nbg6716)
+		lan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +2)
+		wan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +3)
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
index 3240026aec..f8241541cd 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
+++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -46,6 +46,10 @@  case "$FIRMWARE" in
 		caldata_extract "radiocfg" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan24mac")
 		;;
+	zyxel,nbg6716)
+		ath9k_eeprom_extract "art" 0x1000 0x440
+		ath9k_patch_fw_mac $(mtd_get_mac_ascii u-boot-env ethaddr) 0x2
+		;;
 	*)
 		caldata_die "board $board is not supported yet"
 		;;
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 8ab0f6f6ad..8b885864c6 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -41,6 +41,10 @@  case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
 		;;
+	zyxel,nbg6716)
+		ath10kcal_extract "art" 0x5000 0x844
+		ath10kcal_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
+		;;
 	engenius,ews511ap)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
index 37a1346fe7..637bfe9ea0 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
+++ b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
@@ -14,6 +14,7 @@  migrate_wifi_path() {
 			board=$(board_name)
 
 			case "$board" in
+				zyxel,nbg6716|\
 				tplink,archer-c7-v1|\
 				tplink,archer-c7-v2)
 					path="pci0000:00/0000:00:00.0"
diff --git a/target/linux/ath79/base-files/lib/upgrade/platform.sh b/target/linux/ath79/base-files/lib/upgrade/platform.sh
index f4fca06384..46bd6ab9ef 100644
--- a/target/linux/ath79/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/base-files/lib/upgrade/platform.sh
@@ -51,6 +51,9 @@  platform_do_upgrade() {
 	ubnt,routerstation-pro)
 		redboot_fis_do_upgrade "$1" kernel
 		;;
+	zyxel,nbg6716)
+		nand_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$1"
 		;;
diff --git a/target/linux/ath79/dts/qca9557.dtsi b/target/linux/ath79/dts/qca9557.dtsi
index b29dfc72b2..61e1d5f6a4 100644
--- a/target/linux/ath79/dts/qca9557.dtsi
+++ b/target/linux/ath79/dts/qca9557.dtsi
@@ -178,6 +178,24 @@ 
 			};
 		};
 
+		nand: nand@1b800200 {
+			compatible = "qca,ar934x-nand";
+			reg = <0x1b800200 0xb8>;
+
+			interrupts = <21>;
+			interrupt-parent = <&miscintc>;
+
+			resets = <&rst 14>;
+			reset-names = "nand";
+
+			nand-ecc-mode = "hw";
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+		};
+
 		gmac: gmac@18070000 {
 			compatible = "qca,qca9550-gmac";
 			reg = <0x18070000 0x58>;
diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
new file mode 100644
index 0000000000..677aa7aac5
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
@@ -0,0 +1,302 @@ 
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "qca9557.dtsi"
+
+/ {
+	compatible = "zyxel,nbg6716", "qca,qca9558";
+	model = "ZyXEL NBG6716";
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+		label-mac-device = &eth0;
+	};
+	leds {
+		compatible = "gpio-leds";
+
+		power: power {
+			label = "nbg6716:white:power";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "nbg6716:white:internet";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+		usb1 {
+			label = "nbg6716:white:usb1";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port0>;
+		};
+		usb2 {
+			label = "nbg6716:white:usb2";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port1>;
+		};
+		wifi2 {
+			label = "nbg6716:white:wifi2";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+		wifi5 {
+			label = "nbg6716:white:wifi5";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+		wps {
+			label = "nbg6716:white:wps";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        wifi_button {
+                        label = "WiFi button";
+			linux,code = <KEY_RFKILL>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        usb1 {
+                        label = "USB1 eject button";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        usb2 {
+                        label = "USB2 eject button";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "WPS button";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		gpio_usb_power {
+			gpio-export,name = "nbg6716:power:usb";
+			gpio-export,output = <1>;
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&spi {
+	status = "okay";
+	num-cs = <1>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			uboot: partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+                        partition@40000 {
+                                label = "u-boot-env";
+                                reg = <0x040000 0x010000>;
+                        };
+
+			art: partition@50000 {
+				label = "art";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "nbu";
+				reg = <0x060000 0xFA0000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "zyxel_rfsd";
+			reg = <0x0 0x200000>;
+		};
+
+		partition@200000 {
+			label = "romd";
+			reg = <0x200000 0x200000>;
+		};
+
+		partition@400000 {
+			label = "header";
+			reg = <0x400000 0x100000>;
+		};
+
+		firmware@500000 {
+			label = "firmware";
+			reg = <0x500000 0x7B00000>;
+		};
+
+		partition@500000 {
+			label = "kernel";
+			reg = <0x500000 0x400000>;
+		};
+
+		partition@900000 {
+			label = "ubi";
+			reg = <0x900000 0x7700000>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <17>;
+		phy-mode = "rgmii-id";
+	};
+
+	switch0@1f {
+		compatible = "qca,ar8327";
+		reg = <0x1f>;
+		qca,ar8327-initvals = <
+			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
+			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
+			0x10 0x81000080 /* POWER_ON_STRIP */
+			0x50 0xffb7ffb7 /* LED_CTRL0 */
+			0x54 0xffb7ffb7 /* LED_CTRL1 */
+			0x58 0xffb7ffb7 /* LED_CTRL2 */
+			0x5c 0x03ffff00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6 STATUS */
+			>;
+	};
+};
+
+&mdio1 {
+	status = "okay";
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+		phy-mode = "sgmii";
+	};
+};
+
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0xa6000000 0x00000101 0x00001616>;
+	mtd-mac-address = <&uboot 0x5E2>;
+	phy-handle = <&phy0>;
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+	mtd-mac-address = <&uboot 0x5E2>;
+	mtd-mac-address-increment = <1>;
+	phy-handle = <&phy1>;
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+// This node is required for the Ethernet ports to work correctly.
+&gpio {
+	status = "okay";
+};
+
+&wmac {
+	status = "okay";
+	mtd-cal-data = <&art 0x1000>;
+	mtd-mac-address = <&uboot 0x5E2>;
+	mtd-mac-address-increment = <3>;
+};
+
+&pcie1 {
+        status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+	};
+};
+
+&usb_phy0 {
+        status = "okay";
+};
+
+&usb_phy1 {
+        status = "okay";
+};
+
+&usb0 {
+        status = "okay";
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+
+};
+
+&usb1 {
+        status = "okay";
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
index 24768ef5e0..21775b4b48 100644
--- a/target/linux/ath79/image/Makefile
+++ b/target/linux/ath79/image/Makefile
@@ -77,6 +77,8 @@  include ./generic-ubnt.mk
 endif
 ifeq ($(SUBTARGET),nand)
 include ./nand.mk
+include ./nand-netgear.mk
+include ./nand-zyxel.mk
 endif
 ifeq ($(SUBTARGET),tiny)
 include ./tiny.mk
diff --git a/target/linux/ath79/image/common-zyxel.mk b/target/linux/ath79/image/common-zyxel.mk
new file mode 100644
index 0000000000..74f699c7df
--- /dev/null
+++ b/target/linux/ath79/image/common-zyxel.mk
@@ -0,0 +1,28 @@ 
+DEVICE_VARS += ZYXEL_BOARD_ID 
+
+# attention: only zlib compression is allowed for the boot fs
+define  Build/zyxel-buildkerneljffs
+        rm -rf  $(KDIR_TMP)/zyxelnbg6716
+        mkdir -p $(KDIR_TMP)/zyxelnbg6716/image/boot
+        cp $@ $(KDIR_TMP)/zyxelnbg6716/image/boot/vmlinux.lzma.uImage
+        $(STAGING_DIR_HOST)/bin/mkfs.jffs2 \
+                --big-endian --squash-uids -v -e 128KiB -q -f -n -x lzma -x rtime \
+                -o $@ \
+                -d $(KDIR_TMP)/zyxelnbg6716/image
+        rm -rf $(KDIR_TMP)/zyxelnbg6716
+endef
+
+define Build/zyxel-factory
+        cp $@ $(KDIR_TMP)/factory.bin
+        ( \
+                cd $(KDIR_TMP) && \
+                $(STAGING_DIR_HOST)/bin/mkzyxfw-nbg6716 \
+                        -i factory.bin \
+                        -v "OpenWrt Linux-$(LINUX_VERSION)" \
+                        -p "$(ZYXEL_BOARD_ID)" \
+                        -s 0x20000 \
+                        -o ras.bin \
+        )
+        cat $(KDIR_TMP)/ras.bin $(KDIR_TMP)/factory.bin >$@
+        rm $(KDIR_TMP)/factory.bin $(KDIR_TMP)/ras.bin
+endef
diff --git a/target/linux/ath79/image/nand-zyxel.mk b/target/linux/ath79/image/nand-zyxel.mk
new file mode 100644
index 0000000000..bc177fa49c
--- /dev/null
+++ b/target/linux/ath79/image/nand-zyxel.mk
@@ -0,0 +1,20 @@ 
+include ./common-zyxel.mk
+
+define Device/zyxel_nbg6716
+  ATH_SOC := qca9558
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct-htt
+  ZYXEL_BOARD_ID := NBG6716
+  KERNEL_SIZE := 4096k
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 125000k
+  KERNEL := kernel-bin | append-dtb | uImage none | \
+	zyxel-buildkerneljffs | check-size 4096k
+  IMAGES := factory.ras sysupgrade.tar sysupgrade-4M-Kernel.bin
+  IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-to $$$${BLOCKSIZE} | sysupgrade-tar rootfs=$$$$@ | append-metadata
+  IMAGE/sysupgrade-4M-Kernel.bin/squashfs := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi
+  IMAGE/factory.ras := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | zyxel-factory
+  UBINIZE_OPTS := -E 5
+endef
+TARGET_DEVICES += zyxel_nbg6716