[OpenWrt-Devel,3/3] ath79: add support for ZyXEL NBG6716
diff mbox series

Message ID 20191022095149.2385-4-avalentin@marcant.net
State Superseded
Headers show
Series
  • ZyXEL NBG6716 update ar71xx, add ath79, add mtd mac parser
Related show

Commit Message

André Valentin Oct. 22, 2019, 9:51 a.m. UTC
Attention: Kernel partition size has been enlarged to 4MB.
To switch, you must update to latest ar71xx-nand snapshort and flash the
sysupgrade-4M-Kernel.bin:

zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
You will end up with a fresh config if you do not inject config into the image.

Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|   Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

|NBG6716> HELP
|ATEN    x[,y]     set BootExtension Debug Flag (y=password)
|ATSE    x         show the seed of password generator
|ATSH              dump manufacturer related data in ROM
|ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO              boot up whole system
|ATUR    x         upgrade RAS image (filename)
|NBG6716>

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

|NBG6716> ATSE NBG6716
|012345678901

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711

copy and paste the result into the shell to unlock zloader.

|NBG6716> ATEN 1,0046B0017430

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

|NBG6716> ATGU
|NBG6716#

idsfg

Signed-off-by: André Valentin <avalentin@marcant.net>
---
 .../ath79/base-files/etc/board.d/02_network   |   8 +
 .../etc/hotplug.d/firmware/10-ath9k-eeprom    |   4 +
 .../etc/hotplug.d/firmware/11-ath10k-caldata  |   4 +
 .../etc/hotplug.d/ieee80211/00-wifi-migration |   3 +-
 .../ath79/base-files/lib/upgrade/platform.sh  |   3 +
 target/linux/ath79/dts/qca9557.dtsi           |  18 ++
 .../linux/ath79/dts/qca9558_zyxel_nbg6716.dts | 296 ++++++++++++++++++
 target/linux/ath79/image/Makefile             |   1 +
 target/linux/ath79/image/common-zyxel.mk      |  29 ++
 target/linux/ath79/image/nand-zyxel.mk        |  21 ++
 10 files changed, 386 insertions(+), 1 deletion(-)
 create mode 100644 target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
 create mode 100644 target/linux/ath79/image/common-zyxel.mk
 create mode 100644 target/linux/ath79/image/nand-zyxel.mk

Comments

Adrian Schmutzler Oct. 22, 2019, 6:01 p.m. UTC | #1
Hi,

> -----Original Message-----
> From: openwrt-devel [mailto:openwrt-devel-bounces@lists.openwrt.org] On Behalf Of André Valentin
> Sent: Dienstag, 22. Oktober 2019 11:52
> To: openwrt-devel@lists.openwrt.org
> Cc: avalentin@marcant.net
> Subject: [OpenWrt-Devel] [PATCH 3/3] ath79: add support for ZyXEL NBG6716
> 
> Attention: Kernel partition size has been enlarged to 4MB.
> To switch, you must update to latest ar71xx-nand snapshort and flash the
> sysupgrade-4M-Kernel.bin:
> 
> zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
> You will end up with a fresh config if you do not inject config into the image.
> 
> Access the real u-boot shell:
> ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
> When the device is starting up, the user can enter the the loader shell
> by simply pressing a key within the 3 seconds once the following string
> appears on the serial console:
> 
> |   Hit any key to stop autoboot:  3
> 
> The user is then dropped to a locked shell.
> 
> |NBG6716> HELP
> |ATEN    x[,y]     set BootExtension Debug Flag (y=password)
> |ATSE    x         show the seed of password generator
> |ATSH              dump manufacturer related data in ROM
> |ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
> |ATGO              boot up whole system
> |ATUR    x         upgrade RAS image (filename)
> |NBG6716>
> 
> In order to escape/unlock a password challenge has to be passed.
> Note: the value is dynamic! you have to calculate your own!
> 
> First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
> to get the challange value/seed.
> 
> |NBG6716> ATSE NBG6716
> |012345678901
> 
> This seed/value can be converted to the password with the help of this
> bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
> 
> - tool.sh -
> ror32() {
>   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
> }
> v="0x$1"
> a="0x${v:2:6}"
> b=$(( $a + 0x10F0A563))
> c=$(( 0x${v:12:14} & 7 ))
> p=$(( $(ror32 $b $c) ^ $a ))
> printf "ATEN 1,%X\n" $p
> - end of tool.sh -
> 
> |# bash ./tool.sh 012345678901
> |
> |ATEN 1,879C711
> 
> copy and paste the result into the shell to unlock zloader.
> 
> |NBG6716> ATEN 1,0046B0017430
> 
> If the entered code was correct the shell will change to
> use the ATGU command to enter the real u-boot shell.
> 
> |NBG6716> ATGU
> |NBG6716#
> 
> idsfg
> 
> Signed-off-by: André Valentin <avalentin@marcant.net>
> ---
>  .../ath79/base-files/etc/board.d/02_network   |   8 +
>  .../etc/hotplug.d/firmware/10-ath9k-eeprom    |   4 +
>  .../etc/hotplug.d/firmware/11-ath10k-caldata  |   4 +
>  .../etc/hotplug.d/ieee80211/00-wifi-migration |   3 +-
>  .../ath79/base-files/lib/upgrade/platform.sh  |   3 +
>  target/linux/ath79/dts/qca9557.dtsi           |  18 ++
>  .../linux/ath79/dts/qca9558_zyxel_nbg6716.dts | 296 ++++++++++++++++++
>  target/linux/ath79/image/Makefile             |   1 +
>  target/linux/ath79/image/common-zyxel.mk      |  29 ++
>  target/linux/ath79/image/nand-zyxel.mk        |  21 ++
>  10 files changed, 386 insertions(+), 1 deletion(-)
>  create mode 100644 target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
>  create mode 100644 target/linux/ath79/image/common-zyxel.mk
>  create mode 100644 target/linux/ath79/image/nand-zyxel.mk
> 
> diff --git a/target/linux/ath79/base-files/etc/board.d/02_network b/target/linux/ath79/base-files/etc/board.d/02_network
> index fe74bddbf1..42f3462b89 100755
> --- a/target/linux/ath79/base-files/etc/board.d/02_network
> +++ b/target/linux/ath79/base-files/etc/board.d/02_network
> @@ -301,6 +301,10 @@ ath79_setup_interfaces()
>  		ucidef_add_switch "switch0" \
>  			"0@eth0" "3:lan:1" "4:lan:2"
>  		;;
> +	zyxel,nbg6716)
> +		ucidef_add_switch "switch0" \
> +			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
> +		;;
>  	*)
>  		ucidef_set_interfaces_lan_wan "eth0" "eth1"
>  		;;
> @@ -435,6 +439,10 @@ ath79_setup_macs()
>  	wd,mynet-wifi-rangeextender)
>  		lan_mac=$(nvram get et0macaddr)
>  		;;
> +	zyxel,nbg6716)
> +		lan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +2)
> +		wan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +3)
> +		;;
>  	esac
> 
>  	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/base-
> files/etc/hotplug.d/firmware/10-ath9k-eeprom
> index 3240026aec..cfffe5702a 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
> @@ -46,6 +46,10 @@ case "$FIRMWARE" in
>  		caldata_extract "radiocfg" 0x1000 0x440
>  		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan24mac")
>  		;;
> +	zyxel,nbg6716)
> +		caldata_extract "art" 0x1000 0x440
> +		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env ethaddr) 0x2

You need to remove the "0x2".

> +		;;
>  	*)
>  		caldata_die "board $board is not supported yet"
>  		;;
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-
> files/etc/hotplug.d/firmware/11-ath10k-caldata
> index 8ab0f6f6ad..cc0cd2b7c0 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
> @@ -112,6 +112,10 @@ case "$FIRMWARE" in
>  	ubnt,unifiac-pro)
>  		caldata_extract "EEPROM" 0x5000 0x844
>  		;;
> +	zyxel,nbg6716)
> +		caldata_extract "art" 0x5000 0x844
> +		ath10kcal_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
> +		;;
>  	esac
>  	;;
>  "ath10k/pre-cal-pci-0000:00:00.0.bin")
> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration b/target/linux/ath79/base-
> files/etc/hotplug.d/ieee80211/00-wifi-migration
> index 37a1346fe7..b0a5d79f9d 100644
> --- a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
> +++ b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
> @@ -15,7 +15,8 @@ migrate_wifi_path() {
> 
>  			case "$board" in
>  				tplink,archer-c7-v1|\
> -				tplink,archer-c7-v2)
> +				tplink,archer-c7-v2|\
> +				zyxel,nbg6716)
>  					path="pci0000:00/0000:00:00.0"
>  					WIFI_PATH_CHANGED=1
>  				;;
> diff --git a/target/linux/ath79/base-files/lib/upgrade/platform.sh b/target/linux/ath79/base-files/lib/upgrade/platform.sh
> index f4fca06384..46bd6ab9ef 100644
> --- a/target/linux/ath79/base-files/lib/upgrade/platform.sh
> +++ b/target/linux/ath79/base-files/lib/upgrade/platform.sh
> @@ -51,6 +51,9 @@ platform_do_upgrade() {
>  	ubnt,routerstation-pro)
>  		redboot_fis_do_upgrade "$1" kernel
>  		;;
> +	zyxel,nbg6716)
> +		nand_do_upgrade "$1"
> +		;;
>  	*)
>  		default_do_upgrade "$1"
>  		;;
> diff --git a/target/linux/ath79/dts/qca9557.dtsi b/target/linux/ath79/dts/qca9557.dtsi
> index b29dfc72b2..61e1d5f6a4 100644
> --- a/target/linux/ath79/dts/qca9557.dtsi
> +++ b/target/linux/ath79/dts/qca9557.dtsi
> @@ -178,6 +178,24 @@
>  			};
>  		};
> 
> +		nand: nand@1b800200 {
> +			compatible = "qca,ar934x-nand";
> +			reg = <0x1b800200 0xb8>;
> +
> +			interrupts = <21>;
> +			interrupt-parent = <&miscintc>;
> +
> +			resets = <&rst 14>;
> +			reset-names = "nand";
> +
> +			nand-ecc-mode = "hw";
> +
> +			#address-cells = <1>;
> +			#size-cells = <0>;
> +
> +			status = "disabled";
> +		};
> +
>  		gmac: gmac@18070000 {
>  			compatible = "qca,qca9550-gmac";
>  			reg = <0x18070000 0x58>;
> diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
> new file mode 100644
> index 0000000000..e0065cc012
> --- /dev/null
> +++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
> @@ -0,0 +1,296 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
> +/dts-v1/;
> +
> +#include <dt-bindings/gpio/gpio.h>
> +#include <dt-bindings/input/input.h>
> +
> +#include "qca9557.dtsi"
> +
> +/ {
> +	compatible = "zyxel,nbg6716", "qca,qca9558";
> +	model = "ZyXEL NBG6716";
> +
> +	chosen {
> +		bootargs = "console=ttyS0,115200n8";
> +	};
> +
> +	aliases {
> +		led-boot = &power;
> +		led-failsafe = &power;
> +		led-running = &power;
> +		led-upgrade = &power;
> +		label-mac-device = &eth0;

This won't work after you have removed the mtd-mac-address entries from DTS.
You will need to use label_mac in 02_network.

Despite, I'm still waiting for your explanation on the MAC address assignment.

> +	};

Empty line missing.

> +	leds {
> +		compatible = "gpio-leds";
> +
> +		power: power {
> +			label = "nbg6716:white:power";
> +			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
> +		};
> +
> +		wan {
> +			label = "nbg6716:white:internet";
> +			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
> +		};
> +		usb1 {
> +			label = "nbg6716:white:usb1";
> +			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "usbport";
> +			trigger-sources = <&hub_port0>;
> +		};
> +		usb2 {
> +			label = "nbg6716:white:usb2";
> +			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "usbport";
> +			trigger-sources = <&hub_port1>;
> +		};
> +		wifi2 {
> +			label = "nbg6716:white:wifi2";
> +			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "phy1tpt";
> +		};
> +		wifi5 {
> +			label = "nbg6716:white:wifi5";
> +			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
> +			linux,default-trigger = "phy0tpt";
> +		};
> +		wps {
> +			label = "nbg6716:white:wps";
> +			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
> +		};

All nodes should be separated by one empty line, but without an empty line at the beginning and the end inside the parent node.

> +	};
> +
> +	keys {
> +		compatible = "gpio-keys";
> +
> +		reset {
> +			label = "reset";
> +			linux,code = <KEY_RESTART>;
> +			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        wifi_button {
> +                        label = "WiFi button";
> +			linux,code = <KEY_RFKILL>;
> +			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        usb1 {
> +                        label = "USB1 eject button";
> +			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +
> +	        usb2 {
> +                        label = "USB2 eject button";
> +			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};

Here, the indent is wrong.

> +
> +		wps {
> +			label = "WPS button";
> +			linux,code = <KEY_WPS_BUTTON>;
> +			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
> +			debounce-interval = <60>;
> +		};
> +	};
> +	gpio-export {
> +		compatible = "gpio-export";
> +		#size-cells = <0>;
> +
> +		gpio_usb_power {
> +			gpio-export,name = "nbg6716:power:usb";
> +			gpio-export,output = <1>;
> +			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
> +		};
> +	};

gpio-export is deprecated. Have a look at gpio-hog (should be easy to grep inside the ath79 target).

> +};
> +
> +&uart {
> +	status = "okay";
> +};
> +
> +&spi {
> +	status = "okay";
> +	num-cs = <1>;
> +
> +	flash@0 {
> +		compatible = "jedec,spi-nor";
> +		reg = <0>;
> +		spi-max-frequency = <25000000>;
> +
> +		partitions {
> +			compatible = "fixed-partitions";
> +			#address-cells = <1>;
> +			#size-cells = <1>;
> +
> +			uboot: partition@0 {
> +				label = "u-boot";
> +				reg = <0x000000 0x040000>;
> +				read-only;
> +			};
> +
> +                        uboot_env: partition@40000 {
> +                                label = "u-boot-env";
> +                                reg = <0x040000 0x010000>;
> +                        };

Indent!

> +
> +			art: partition@50000 {
> +				label = "art";
> +				reg = <0x050000 0x010000>;
> +				read-only;
> +			};
> +
> +			partition@60000 {
> +				label = "nbu";
> +				reg = <0x060000 0xFA0000>;

Consider switching to lower case.

> +			};
> +		};
> +	};
> +};
> +
> +&nand {
> +	status = "okay";
> +
> +	partitions {
> +		compatible = "fixed-partitions";
> +		#address-cells = <1>;
> +		#size-cells = <1>;
> +
> +		partition@0 {
> +			label = "zyxel_rfsd";
> +			reg = <0x0 0x200000>;
> +		};
> +
> +		partition@200000 {
> +			label = "romd";
> +			reg = <0x200000 0x200000>;
> +		};
> +
> +		partition@400000 {
> +			label = "header";
> +			reg = <0x400000 0x100000>;
> +		};
> +
> +		firmware@500000 {
> +			label = "firmware";
> +			reg = <0x500000 0x7B00000>;

Consider switching to lower case.

> +		};
> +
> +		partition@500000 {
> +			label = "kernel";
> +			reg = <0x500000 0x400000>;
> +		};
> +
> +		partition@900000 {
> +			label = "ubi";
> +			reg = <0x900000 0x7700000>;
> +		};
> +	};
> +};
> +
> +&mdio0 {
> +	status = "okay";
> +
> +	phy0: ethernet-phy@0 {
> +		reg = <17>;
> +		phy-mode = "rgmii-id";
> +	};
> +
> +	switch0@1f {
> +		compatible = "qca,ar8327";
> +		reg = <0x1f>;
> +		qca,ar8327-initvals = <
> +			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
> +			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
> +			0x10 0x81000080 /* POWER_ON_STRIP */
> +			0x50 0xffb7ffb7 /* LED_CTRL0 */
> +			0x54 0xffb7ffb7 /* LED_CTRL1 */
> +			0x58 0xffb7ffb7 /* LED_CTRL2 */
> +			0x5c 0x03ffff00 /* LED_CTRL3 */
> +			0x7c 0x0000007e /* PORT0_STATUS */
> +			0x94 0x0000007e /* PORT6 STATUS */
> +			>;
> +	};
> +};
> +
> +&mdio1 {
> +	status = "okay";
> +
> +	phy1: ethernet-phy@1 {
> +		reg = <1>;
> +		phy-mode = "sgmii";
> +	};
> +};
> +
> +
> +&eth0 {
> +	status = "okay";
> +
> +	pll-data = <0xa6000000 0x00000101 0x00001616>;
> +	phy-handle = <&phy0>;
> +	fixed-link {
> +		speed = <1000>;
> +		full-duplex;
> +	};
> +};
> +
> +&eth1 {
> +	status = "okay";
> +
> +	pll-data = <0x03000101 0x00000101 0x00001616>;
> +	phy-handle = <&phy1>;
> +	fixed-link {
> +		speed = <1000>;
> +		full-duplex;
> +	};
> +};
> +
> +&gpio {
> +	status = "okay";
> +};
> +
> +&wmac {
> +	status = "okay";
> +};
> +
> +&pcie1 {
> +        status = "okay";
> +
> +	wifi@0,0 {
> +		compatible = "qcom,ath10k";
> +		reg = <0 0 0 0 0>;
> +		qcom,ath10k-calibration-variant = "ZyXEL-NBG6716";
> +	};
> +};
> +
> +&usb_phy0 {
> +        status = "okay";
> +};
> +
> +&usb_phy1 {
> +        status = "okay";
> +};
> +
> +&usb0 {
> +        status = "okay";
> +
> +	hub_port0: port@1 {
> +		reg = <1>;
> +		#trigger-source-cells = <0>;
> +	};
> +
> +};
> +
> +&usb1 {
> +        status = "okay";
> +
> +	hub_port1: port@1 {
> +		reg = <1>;
> +		#trigger-source-cells = <0>;
> +	};
> +};
> +

Remove empty line at the end.

> diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
> index 24768ef5e0..074d7ead02 100644
> --- a/target/linux/ath79/image/Makefile
> +++ b/target/linux/ath79/image/Makefile
> @@ -77,6 +77,7 @@ include ./generic-ubnt.mk
>  endif
>  ifeq ($(SUBTARGET),nand)
>  include ./nand.mk
> +include ./nand-zyxel.mk

At the moment, we have _one_ device inside nand.mk (and still only four after jeffsf's changes).

I strongly suggest to just put the contents of both common-zyxel.mk and nand-zyxel.mk into nand.mk, and not have one file per definition.

Best

Adrian
André Valentin Oct. 23, 2019, 9 a.m. UTC | #2
Hi Adrian,

thanks you for your hints! Please see below for comments.

Am 22.10.19 um 20:01 schrieb Adrian Schmutzler:
> Hi,
> 
>> -----Original Message-----
>> From: openwrt-devel [mailto:openwrt-devel-bounces@lists.openwrt.org] On Behalf Of André Valentin
>> Sent: Dienstag, 22. Oktober 2019 11:52
>> To: openwrt-devel@lists.openwrt.org
>> Cc: avalentin@marcant.net
>> Subject: [OpenWrt-Devel] [PATCH 3/3] ath79: add support for ZyXEL NBG6716
>>
>> Attention: Kernel partition size has been enlarged to 4MB.
>> To switch, you must update to latest ar71xx-nand snapshort and flash the
>> sysupgrade-4M-Kernel.bin:
>>
>> zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f
>> You will end up with a fresh config if you do not inject config into the image.
>>
>> Access the real u-boot shell:
>> ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
>> When the device is starting up, the user can enter the the loader shell
>> by simply pressing a key within the 3 seconds once the following string
>> appears on the serial console:
>>
>> |   Hit any key to stop autoboot:  3
>>
>> The user is then dropped to a locked shell.
>>
>> |NBG6716> HELP
>> |ATEN    x[,y]     set BootExtension Debug Flag (y=password)
>> |ATSE    x         show the seed of password generator
>> |ATSH              dump manufacturer related data in ROM
>> |ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
>> |ATGO              boot up whole system
>> |ATUR    x         upgrade RAS image (filename)
>> |NBG6716>
>>
>> In order to escape/unlock a password challenge has to be passed.
>> Note: the value is dynamic! you have to calculate your own!
>>
>> First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
>> to get the challange value/seed.
>>
>> |NBG6716> ATSE NBG6716
>> |012345678901
>>
>> This seed/value can be converted to the password with the help of this
>> bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
>>
>> - tool.sh -
>> ror32() {
>>   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
>> }
>> v="0x$1"
>> a="0x${v:2:6}"
>> b=$(( $a + 0x10F0A563))
>> c=$(( 0x${v:12:14} & 7 ))
>> p=$(( $(ror32 $b $c) ^ $a ))
>> printf "ATEN 1,%X\n" $p
>> - end of tool.sh -
>>
>> |# bash ./tool.sh 012345678901
>> |
>> |ATEN 1,879C711
>>
>> copy and paste the result into the shell to unlock zloader.
>>
>> |NBG6716> ATEN 1,0046B0017430
>>
>> If the entered code was correct the shell will change to
>> use the ATGU command to enter the real u-boot shell.
>>
>> |NBG6716> ATGU
>> |NBG6716#
>>
>> idsfg
>>
>> Signed-off-by: André Valentin <avalentin@marcant.net>
>> ---
>>  .../ath79/base-files/etc/board.d/02_network   |   8 +
>>  .../etc/hotplug.d/firmware/10-ath9k-eeprom    |   4 +
>>  .../etc/hotplug.d/firmware/11-ath10k-caldata  |   4 +
>>  .../etc/hotplug.d/ieee80211/00-wifi-migration |   3 +-
>>  .../ath79/base-files/lib/upgrade/platform.sh  |   3 +
>>  target/linux/ath79/dts/qca9557.dtsi           |  18 ++
>>  .../linux/ath79/dts/qca9558_zyxel_nbg6716.dts | 296 ++++++++++++++++++
>>  target/linux/ath79/image/Makefile             |   1 +
>>  target/linux/ath79/image/common-zyxel.mk      |  29 ++
>>  target/linux/ath79/image/nand-zyxel.mk        |  21 ++
>>  10 files changed, 386 insertions(+), 1 deletion(-)
>>  create mode 100644 target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
>>  create mode 100644 target/linux/ath79/image/common-zyxel.mk
>>  create mode 100644 target/linux/ath79/image/nand-zyxel.mk
>>
>> diff --git a/target/linux/ath79/base-files/etc/board.d/02_network b/target/linux/ath79/base-files/etc/board.d/02_network
>> index fe74bddbf1..42f3462b89 100755
>> --- a/target/linux/ath79/base-files/etc/board.d/02_network
>> +++ b/target/linux/ath79/base-files/etc/board.d/02_network
>> @@ -301,6 +301,10 @@ ath79_setup_interfaces()
>>  		ucidef_add_switch "switch0" \
>>  			"0@eth0" "3:lan:1" "4:lan:2"
>>  		;;
>> +	zyxel,nbg6716)
>> +		ucidef_add_switch "switch0" \
>> +			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
>> +		;;
>>  	*)
>>  		ucidef_set_interfaces_lan_wan "eth0" "eth1"
>>  		;;
>> @@ -435,6 +439,10 @@ ath79_setup_macs()
>>  	wd,mynet-wifi-rangeextender)
>>  		lan_mac=$(nvram get et0macaddr)
>>  		;;
>> +	zyxel,nbg6716)
>> +		lan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +2)
>> +		wan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +3)
>> +		;;
>>  	esac
>>
>>  	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
>> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/base-
>> files/etc/hotplug.d/firmware/10-ath9k-eeprom
>> index 3240026aec..cfffe5702a 100644
>> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
>> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
>> @@ -46,6 +46,10 @@ case "$FIRMWARE" in
>>  		caldata_extract "radiocfg" 0x1000 0x440
>>  		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan24mac")
>>  		;;
>> +	zyxel,nbg6716)
>> +		caldata_extract "art" 0x1000 0x440
>> +		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env ethaddr) 0x2
> 
> You need to remove the "0x2".
Fixed!

> 
>> +		;;
>>  	*)
>>  		caldata_die "board $board is not supported yet"
>>  		;;
>> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-
>> files/etc/hotplug.d/firmware/11-ath10k-caldata
>> index 8ab0f6f6ad..cc0cd2b7c0 100644
>> --- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
>> +++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
>> @@ -112,6 +112,10 @@ case "$FIRMWARE" in
>>  	ubnt,unifiac-pro)
>>  		caldata_extract "EEPROM" 0x5000 0x844
>>  		;;
>> +	zyxel,nbg6716)
>> +		caldata_extract "art" 0x5000 0x844
>> +		ath10kcal_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
>> +		;;
>>  	esac
>>  	;;
>>  "ath10k/pre-cal-pci-0000:00:00.0.bin")
>> diff --git a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration b/target/linux/ath79/base-
>> files/etc/hotplug.d/ieee80211/00-wifi-migration
>> index 37a1346fe7..b0a5d79f9d 100644
>> --- a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
>> +++ b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
>> @@ -15,7 +15,8 @@ migrate_wifi_path() {
>>
>>  			case "$board" in
>>  				tplink,archer-c7-v1|\
>> -				tplink,archer-c7-v2)
>> +				tplink,archer-c7-v2|\
>> +				zyxel,nbg6716)
>>  					path="pci0000:00/0000:00:00.0"
>>  					WIFI_PATH_CHANGED=1
>>  				;;
>> diff --git a/target/linux/ath79/base-files/lib/upgrade/platform.sh b/target/linux/ath79/base-files/lib/upgrade/platform.sh
>> index f4fca06384..46bd6ab9ef 100644
>> --- a/target/linux/ath79/base-files/lib/upgrade/platform.sh
>> +++ b/target/linux/ath79/base-files/lib/upgrade/platform.sh
>> @@ -51,6 +51,9 @@ platform_do_upgrade() {
>>  	ubnt,routerstation-pro)
>>  		redboot_fis_do_upgrade "$1" kernel
>>  		;;
>> +	zyxel,nbg6716)
>> +		nand_do_upgrade "$1"
>> +		;;
>>  	*)
>>  		default_do_upgrade "$1"
>>  		;;
>> diff --git a/target/linux/ath79/dts/qca9557.dtsi b/target/linux/ath79/dts/qca9557.dtsi
>> index b29dfc72b2..61e1d5f6a4 100644
>> --- a/target/linux/ath79/dts/qca9557.dtsi
>> +++ b/target/linux/ath79/dts/qca9557.dtsi
>> @@ -178,6 +178,24 @@
>>  			};
>>  		};
>>
>> +		nand: nand@1b800200 {
>> +			compatible = "qca,ar934x-nand";
>> +			reg = <0x1b800200 0xb8>;
>> +
>> +			interrupts = <21>;
>> +			interrupt-parent = <&miscintc>;
>> +
>> +			resets = <&rst 14>;
>> +			reset-names = "nand";
>> +
>> +			nand-ecc-mode = "hw";
>> +
>> +			#address-cells = <1>;
>> +			#size-cells = <0>;
>> +
>> +			status = "disabled";
>> +		};
>> +
>>  		gmac: gmac@18070000 {
>>  			compatible = "qca,qca9550-gmac";
>>  			reg = <0x18070000 0x58>;
>> diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
>> new file mode 100644
>> index 0000000000..e0065cc012
>> --- /dev/null
>> +++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
>> @@ -0,0 +1,296 @@
>> +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
>> +/dts-v1/;
>> +
>> +#include <dt-bindings/gpio/gpio.h>
>> +#include <dt-bindings/input/input.h>
>> +
>> +#include "qca9557.dtsi"
>> +
>> +/ {
>> +	compatible = "zyxel,nbg6716", "qca,qca9558";
>> +	model = "ZyXEL NBG6716";
>> +
>> +	chosen {
>> +		bootargs = "console=ttyS0,115200n8";
>> +	};
>> +
>> +	aliases {
>> +		led-boot = &power;
>> +		led-failsafe = &power;
>> +		led-running = &power;
>> +		led-upgrade = &power;
>> +		label-mac-device = &eth0;
> 
> This won't work after you have removed the mtd-mac-address entries from DTS.
> You will need to use label_mac in 02_network.

I remove label_mac because all 4 MACs are labeled on the device.
> 
> Despite, I'm still waiting for your explanation on the MAC address assignment.

It's a bit unusual
WLAN2 MAC
WLAN5 MAC+1
LAN   MAC+2
WAN   MAC+3

I've doubled checked that in code!

> 
>> +	};
> 
> Empty line missing.
Fixed!
> 
>> +	leds {
>> +		compatible = "gpio-leds";
>> +
>> +		power: power {
>> +			label = "nbg6716:white:power";
>> +			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
>> +		};
>> +
>> +		wan {
>> +			label = "nbg6716:white:internet";
>> +			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
>> +		};
>> +		usb1 {
>> +			label = "nbg6716:white:usb1";
>> +			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
>> +			linux,default-trigger = "usbport";
>> +			trigger-sources = <&hub_port0>;
>> +		};
>> +		usb2 {
>> +			label = "nbg6716:white:usb2";
>> +			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
>> +			linux,default-trigger = "usbport";
>> +			trigger-sources = <&hub_port1>;
>> +		};
>> +		wifi2 {
>> +			label = "nbg6716:white:wifi2";
>> +			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
>> +			linux,default-trigger = "phy1tpt";
>> +		};
>> +		wifi5 {
>> +			label = "nbg6716:white:wifi5";
>> +			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
>> +			linux,default-trigger = "phy0tpt";
>> +		};
>> +		wps {
>> +			label = "nbg6716:white:wps";
>> +			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
>> +		};
> 
> All nodes should be separated by one empty line, but without an empty line at the beginning and the end inside the parent node.
> 
>> +	};
>> +
>> +	keys {
>> +		compatible = "gpio-keys";
>> +
>> +		reset {
>> +			label = "reset";
>> +			linux,code = <KEY_RESTART>;
>> +			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
>> +			debounce-interval = <60>;
>> +		};
>> +
>> +	        wifi_button {
>> +                        label = "WiFi button";
>> +			linux,code = <KEY_RFKILL>;
>> +			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
>> +			debounce-interval = <60>;
>> +		};
>> +
>> +	        usb1 {
>> +                        label = "USB1 eject button";
>> +			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
>> +			debounce-interval = <60>;
>> +		};
>> +
>> +	        usb2 {
>> +                        label = "USB2 eject button";
>> +			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
>> +			debounce-interval = <60>;
>> +		};
> 
> Here, the indent is wrong.
Thanks, fixed!
> 
>> +
>> +		wps {
>> +			label = "WPS button";
>> +			linux,code = <KEY_WPS_BUTTON>;
>> +			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
>> +			debounce-interval = <60>;
>> +		};
>> +	};
>> +	gpio-export {
>> +		compatible = "gpio-export";
>> +		#size-cells = <0>;
>> +
>> +		gpio_usb_power {
>> +			gpio-export,name = "nbg6716:power:usb";
>> +			gpio-export,output = <1>;
>> +			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
>> +		};
>> +	};
> 
> gpio-export is deprecated. Have a look at gpio-hog (should be easy to grep inside the ath79 target).
Switched to gpio-hog. Hope it's correct.
> 
>> +};
>> +
>> +&uart {
>> +	status = "okay";
>> +};
>> +
>> +&spi {
>> +	status = "okay";
>> +	num-cs = <1>;
>> +
>> +	flash@0 {
>> +		compatible = "jedec,spi-nor";
>> +		reg = <0>;
>> +		spi-max-frequency = <25000000>;
>> +
>> +		partitions {
>> +			compatible = "fixed-partitions";
>> +			#address-cells = <1>;
>> +			#size-cells = <1>;
>> +
>> +			uboot: partition@0 {
>> +				label = "u-boot";
>> +				reg = <0x000000 0x040000>;
>> +				read-only;
>> +			};
>> +
>> +                        uboot_env: partition@40000 {
>> +                                label = "u-boot-env";
>> +                                reg = <0x040000 0x010000>;
>> +                        };
> 
> Indent!
Fixed!
> 
>> +
>> +			art: partition@50000 {
>> +				label = "art";
>> +				reg = <0x050000 0x010000>;
>> +				read-only;
>> +			};
>> +
>> +			partition@60000 {
>> +				label = "nbu";
>> +				reg = <0x060000 0xFA0000>;
> 
> Consider switching to lower case.
Switched to lower case.
> 
>> +			};
>> +		};
>> +	};
>> +};
>> +
>> +&nand {
>> +	status = "okay";
>> +
>> +	partitions {
>> +		compatible = "fixed-partitions";
>> +		#address-cells = <1>;
>> +		#size-cells = <1>;
>> +
>> +		partition@0 {
>> +			label = "zyxel_rfsd";
>> +			reg = <0x0 0x200000>;
>> +		};
>> +
>> +		partition@200000 {
>> +			label = "romd";
>> +			reg = <0x200000 0x200000>;
>> +		};
>> +
>> +		partition@400000 {
>> +			label = "header";
>> +			reg = <0x400000 0x100000>;
>> +		};
>> +
>> +		firmware@500000 {
>> +			label = "firmware";
>> +			reg = <0x500000 0x7B00000>;
> 
> Consider switching to lower case.
Also done!
> 
>> +		};
>> +
>> +		partition@500000 {
>> +			label = "kernel";
>> +			reg = <0x500000 0x400000>;
>> +		};
>> +
>> +		partition@900000 {
>> +			label = "ubi";
>> +			reg = <0x900000 0x7700000>;
>> +		};
>> +	};
>> +};
>> +
>> +&mdio0 {
>> +	status = "okay";
>> +
>> +	phy0: ethernet-phy@0 {
>> +		reg = <17>;
>> +		phy-mode = "rgmii-id";
>> +	};
>> +
>> +	switch0@1f {
>> +		compatible = "qca,ar8327";
>> +		reg = <0x1f>;
>> +		qca,ar8327-initvals = <
>> +			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
>> +			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
>> +			0x10 0x81000080 /* POWER_ON_STRIP */
>> +			0x50 0xffb7ffb7 /* LED_CTRL0 */
>> +			0x54 0xffb7ffb7 /* LED_CTRL1 */
>> +			0x58 0xffb7ffb7 /* LED_CTRL2 */
>> +			0x5c 0x03ffff00 /* LED_CTRL3 */
>> +			0x7c 0x0000007e /* PORT0_STATUS */
>> +			0x94 0x0000007e /* PORT6 STATUS */
>> +			>;
>> +	};
>> +};
>> +
>> +&mdio1 {
>> +	status = "okay";
>> +
>> +	phy1: ethernet-phy@1 {
>> +		reg = <1>;
>> +		phy-mode = "sgmii";
>> +	};
>> +};
>> +
>> +
>> +&eth0 {
>> +	status = "okay";
>> +
>> +	pll-data = <0xa6000000 0x00000101 0x00001616>;
>> +	phy-handle = <&phy0>;
>> +	fixed-link {
>> +		speed = <1000>;
>> +		full-duplex;
>> +	};
>> +};
>> +
>> +&eth1 {
>> +	status = "okay";
>> +
>> +	pll-data = <0x03000101 0x00000101 0x00001616>;
>> +	phy-handle = <&phy1>;
>> +	fixed-link {
>> +		speed = <1000>;
>> +		full-duplex;
>> +	};
>> +};
>> +
>> +&gpio {
>> +	status = "okay";
>> +};
>> +
>> +&wmac {
>> +	status = "okay";
>> +};
>> +
>> +&pcie1 {
>> +        status = "okay";
>> +
>> +	wifi@0,0 {
>> +		compatible = "qcom,ath10k";
>> +		reg = <0 0 0 0 0>;
>> +		qcom,ath10k-calibration-variant = "ZyXEL-NBG6716";
>> +	};
>> +};
>> +
>> +&usb_phy0 {
>> +        status = "okay";
>> +};
>> +
>> +&usb_phy1 {
>> +        status = "okay";
>> +};
>> +
>> +&usb0 {
>> +        status = "okay";
>> +
>> +	hub_port0: port@1 {
>> +		reg = <1>;
>> +		#trigger-source-cells = <0>;
>> +	};
>> +
>> +};
>> +
>> +&usb1 {
>> +        status = "okay";
>> +
>> +	hub_port1: port@1 {
>> +		reg = <1>;
>> +		#trigger-source-cells = <0>;
>> +	};
>> +};
>> +
> 
> Remove empty line at the end.
Done!

> 
>> diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
>> index 24768ef5e0..074d7ead02 100644
>> --- a/target/linux/ath79/image/Makefile
>> +++ b/target/linux/ath79/image/Makefile
>> @@ -77,6 +77,7 @@ include ./generic-ubnt.mk
>>  endif
>>  ifeq ($(SUBTARGET),nand)
>>  include ./nand.mk
>> +include ./nand-zyxel.mk
> 
> At the moment, we have _one_ device inside nand.mk (and still only four after jeffsf's changes).
> 
> I strongly suggest to just put the contents of both common-zyxel.mk and nand-zyxel.mk into nand.mk, and not have one file per definition.

I've put it all into nand.mk, I was also unsure if this is not too much.


Kind regards,

André

Patch
diff mbox series

diff --git a/target/linux/ath79/base-files/etc/board.d/02_network b/target/linux/ath79/base-files/etc/board.d/02_network
index fe74bddbf1..42f3462b89 100755
--- a/target/linux/ath79/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/base-files/etc/board.d/02_network
@@ -301,6 +301,10 @@  ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "3:lan:1" "4:lan:2"
 		;;
+	zyxel,nbg6716)
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth1"
+		;;
 	*)
 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
 		;;
@@ -435,6 +439,10 @@  ath79_setup_macs()
 	wd,mynet-wifi-rangeextender)
 		lan_mac=$(nvram get et0macaddr)
 		;;
+	zyxel,nbg6716)
+		lan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +2)
+		wan_mac=$(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +3)
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
index 3240026aec..cfffe5702a 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
+++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom
@@ -46,6 +46,10 @@  case "$FIRMWARE" in
 		caldata_extract "radiocfg" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_ascii devdata "wlan24mac")
 		;;
+	zyxel,nbg6716)
+		caldata_extract "art" 0x1000 0x440
+		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env ethaddr) 0x2
+		;;
 	*)
 		caldata_die "board $board is not supported yet"
 		;;
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 8ab0f6f6ad..cc0cd2b7c0 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ath79/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -112,6 +112,10 @@  case "$FIRMWARE" in
 	ubnt,unifiac-pro)
 		caldata_extract "EEPROM" 0x5000 0x844
 		;;
+	zyxel,nbg6716)
+		caldata_extract "art" 0x5000 0x844
+		ath10kcal_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
+		;;
 	esac
 	;;
 "ath10k/pre-cal-pci-0000:00:00.0.bin")
diff --git a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
index 37a1346fe7..b0a5d79f9d 100644
--- a/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
+++ b/target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration
@@ -15,7 +15,8 @@  migrate_wifi_path() {
 
 			case "$board" in
 				tplink,archer-c7-v1|\
-				tplink,archer-c7-v2)
+				tplink,archer-c7-v2|\
+				zyxel,nbg6716)
 					path="pci0000:00/0000:00:00.0"
 					WIFI_PATH_CHANGED=1
 				;;
diff --git a/target/linux/ath79/base-files/lib/upgrade/platform.sh b/target/linux/ath79/base-files/lib/upgrade/platform.sh
index f4fca06384..46bd6ab9ef 100644
--- a/target/linux/ath79/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ath79/base-files/lib/upgrade/platform.sh
@@ -51,6 +51,9 @@  platform_do_upgrade() {
 	ubnt,routerstation-pro)
 		redboot_fis_do_upgrade "$1" kernel
 		;;
+	zyxel,nbg6716)
+		nand_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$1"
 		;;
diff --git a/target/linux/ath79/dts/qca9557.dtsi b/target/linux/ath79/dts/qca9557.dtsi
index b29dfc72b2..61e1d5f6a4 100644
--- a/target/linux/ath79/dts/qca9557.dtsi
+++ b/target/linux/ath79/dts/qca9557.dtsi
@@ -178,6 +178,24 @@ 
 			};
 		};
 
+		nand: nand@1b800200 {
+			compatible = "qca,ar934x-nand";
+			reg = <0x1b800200 0xb8>;
+
+			interrupts = <21>;
+			interrupt-parent = <&miscintc>;
+
+			resets = <&rst 14>;
+			reset-names = "nand";
+
+			nand-ecc-mode = "hw";
+
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+		};
+
 		gmac: gmac@18070000 {
 			compatible = "qca,qca9550-gmac";
 			reg = <0x18070000 0x58>;
diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
new file mode 100644
index 0000000000..e0065cc012
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts
@@ -0,0 +1,296 @@ 
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "qca9557.dtsi"
+
+/ {
+	compatible = "zyxel,nbg6716", "qca,qca9558";
+	model = "ZyXEL NBG6716";
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+		label-mac-device = &eth0;
+	};
+	leds {
+		compatible = "gpio-leds";
+
+		power: power {
+			label = "nbg6716:white:power";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		wan {
+			label = "nbg6716:white:internet";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+		};
+		usb1 {
+			label = "nbg6716:white:usb1";
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port0>;
+		};
+		usb2 {
+			label = "nbg6716:white:usb2";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "usbport";
+			trigger-sources = <&hub_port1>;
+		};
+		wifi2 {
+			label = "nbg6716:white:wifi2";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+		wifi5 {
+			label = "nbg6716:white:wifi5";
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+		wps {
+			label = "nbg6716:white:wps";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        wifi_button {
+                        label = "WiFi button";
+			linux,code = <KEY_RFKILL>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        usb1 {
+                        label = "USB1 eject button";
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+	        usb2 {
+                        label = "USB2 eject button";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "WPS button";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		gpio_usb_power {
+			gpio-export,name = "nbg6716:power:usb";
+			gpio-export,output = <1>;
+			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&spi {
+	status = "okay";
+	num-cs = <1>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			uboot: partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+                        uboot_env: partition@40000 {
+                                label = "u-boot-env";
+                                reg = <0x040000 0x010000>;
+                        };
+
+			art: partition@50000 {
+				label = "art";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "nbu";
+				reg = <0x060000 0xFA0000>;
+			};
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "zyxel_rfsd";
+			reg = <0x0 0x200000>;
+		};
+
+		partition@200000 {
+			label = "romd";
+			reg = <0x200000 0x200000>;
+		};
+
+		partition@400000 {
+			label = "header";
+			reg = <0x400000 0x100000>;
+		};
+
+		firmware@500000 {
+			label = "firmware";
+			reg = <0x500000 0x7B00000>;
+		};
+
+		partition@500000 {
+			label = "kernel";
+			reg = <0x500000 0x400000>;
+		};
+
+		partition@900000 {
+			label = "ubi";
+			reg = <0x900000 0x7700000>;
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <17>;
+		phy-mode = "rgmii-id";
+	};
+
+	switch0@1f {
+		compatible = "qca,ar8327";
+		reg = <0x1f>;
+		qca,ar8327-initvals = <
+			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
+			0x0c 0x00080080 /* PORT6 PAD MODE CTRL */
+			0x10 0x81000080 /* POWER_ON_STRIP */
+			0x50 0xffb7ffb7 /* LED_CTRL0 */
+			0x54 0xffb7ffb7 /* LED_CTRL1 */
+			0x58 0xffb7ffb7 /* LED_CTRL2 */
+			0x5c 0x03ffff00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6 STATUS */
+			>;
+	};
+};
+
+&mdio1 {
+	status = "okay";
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+		phy-mode = "sgmii";
+	};
+};
+
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0xa6000000 0x00000101 0x00001616>;
+	phy-handle = <&phy0>;
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+	phy-handle = <&phy1>;
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gpio {
+	status = "okay";
+};
+
+&wmac {
+	status = "okay";
+};
+
+&pcie1 {
+        status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0 0 0 0 0>;
+		qcom,ath10k-calibration-variant = "ZyXEL-NBG6716";
+	};
+};
+
+&usb_phy0 {
+        status = "okay";
+};
+
+&usb_phy1 {
+        status = "okay";
+};
+
+&usb0 {
+        status = "okay";
+
+	hub_port0: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+
+};
+
+&usb1 {
+        status = "okay";
+
+	hub_port1: port@1 {
+		reg = <1>;
+		#trigger-source-cells = <0>;
+	};
+};
+
diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
index 24768ef5e0..074d7ead02 100644
--- a/target/linux/ath79/image/Makefile
+++ b/target/linux/ath79/image/Makefile
@@ -77,6 +77,7 @@  include ./generic-ubnt.mk
 endif
 ifeq ($(SUBTARGET),nand)
 include ./nand.mk
+include ./nand-zyxel.mk
 endif
 ifeq ($(SUBTARGET),tiny)
 include ./tiny.mk
diff --git a/target/linux/ath79/image/common-zyxel.mk b/target/linux/ath79/image/common-zyxel.mk
new file mode 100644
index 0000000000..bc7bbc3409
--- /dev/null
+++ b/target/linux/ath79/image/common-zyxel.mk
@@ -0,0 +1,29 @@ 
+DEVICE_VARS += RAS_ROOTFS_SIZE RAS_BOARD RAS_VERSION
+
+# attention: only zlib compression is allowed for the boot fs
+define  Build/zyxel-buildkerneljffs
+        rm -rf  $(KDIR_TMP)/zyxelnbg6716
+        mkdir -p $(KDIR_TMP)/zyxelnbg6716/image/boot
+        cp $@ $(KDIR_TMP)/zyxelnbg6716/image/boot/vmlinux.lzma.uImage
+        $(STAGING_DIR_HOST)/bin/mkfs.jffs2 \
+                --big-endian --squash-uids -v -e 128KiB -q -f -n -x lzma -x rtime \
+                -o $@ \
+                -d $(KDIR_TMP)/zyxelnbg6716/image
+        rm -rf $(KDIR_TMP)/zyxelnbg6716
+endef
+
+define Build/zyxel-factory
+	let \
+		maxsize="$(subst k,* 1024,$(RAS_ROOTFS_SIZE))"; \
+		let size="$$(stat -c%s $@)"; \
+		if [ $$size -lt $$maxsize ]; then \
+			$(STAGING_DIR_HOST)/bin/mkrasimage \
+				-b $(RAS_BOARD) \
+				-v $(RAS_VERSION) \
+				-r $@ \
+				-s $$maxsize \
+				-o $@.new \
+				-l 131072 \
+			&& mv $@.new $@ ; \
+		fi
+endef
diff --git a/target/linux/ath79/image/nand-zyxel.mk b/target/linux/ath79/image/nand-zyxel.mk
new file mode 100644
index 0000000000..d6507e5d45
--- /dev/null
+++ b/target/linux/ath79/image/nand-zyxel.mk
@@ -0,0 +1,21 @@ 
+include ./common-zyxel.mk
+
+define Device/zyxel_nbg6716
+  ATH_SOC := qca9558
+  DEVICE_VENDOR := ZyXEL
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct ath10k-firmware-qca988x-ct
+  RAS_BOARD := NBG6716
+  RAS_ROOTFS_SIZE := 29696k
+  RAS_VERSION := "OpenWrt Linux-$(LINUX_VERSION)"
+  KERNEL_SIZE := 4096k
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL := kernel-bin | append-dtb | uImage none | \
+	zyxel-buildkerneljffs | check-size 4096k
+  IMAGES := sysupgrade.tar sysupgrade-4M-Kernel.bin factory.bin
+  IMAGE/sysupgrade.tar/squashfs := append-rootfs | pad-to $$$${BLOCKSIZE} | sysupgrade-tar rootfs=$$$$@ | append-metadata
+  IMAGE/sysupgrade-4M-Kernel.bin/squashfs := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | pad-to 263192576 | gzip
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-ubi | zyxel-factory
+  UBINIZE_OPTS := -E 5
+endef
+TARGET_DEVICES += zyxel_nbg6716