diff --git a/include/image-commands.mk b/include/image-commands.mk
index 4d3f025b12..28b39c310e 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -49,6 +49,19 @@ define Build/eva-image
 	mv $@.new $@
 endef
 
+define Build/make-ras
+	let \
+		newsize="$(subst k,* 1024,$(RAS_ROOTFS_SIZE))"; \
+		$(TOPDIR)/scripts/make-ras.sh \
+			--board $(RAS_BOARD) \
+			--version $(RAS_VERSION) \
+			--kernel $(call param_get_default,kernel,$(1),$(IMAGE_KERNEL)) \
+			--rootfs $@ \
+			--rootfssize $$newsize \
+			$@.new
+	@mv $@.new $@
+endef
+
 define Build/netgear-chk
 	$(STAGING_DIR_HOST)/bin/mkchkimg \
 		-o $@.new \
diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
index d475e56629..8cd4799b29 100644
--- a/package/boot/uboot-envtools/files/ipq40xx
+++ b/package/boot/uboot-envtools/files/ipq40xx
@@ -35,6 +35,9 @@ openmesh,a42 |\
 openmesh,a62)
 	ubootenv_add_uci_config "/dev/mtd5" "0x0" "0x10000" "0x10000"
 	;;
+zyxel,nbg6617)
+	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
+	;;
 esac
 
 config_load ubootenv
diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
index 1cfcc33de3..b1428f173d 100644
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -14,7 +14,7 @@ define Build/Compile
 endef
 
 #ALLWIFIBOARDS:=<devicename>
-ALLWIFIBOARDS:=zyxel_wre6606
+ALLWIFIBOARDS:=zyxel_nbg6617 zyxel_wre6606
 ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
 
 define Package/ipq-wifi-default
@@ -50,5 +50,6 @@ endef
 
 $(eval $(call generate-ipq-wifi-package,zyxel_wre6606,board-zyxel_wre6606.bin,ZyXEL WRE6606))
 #$(eval $(call generate-ipq-wifi-package,<devicename>,<filename>,<displayname>))
+$(eval $(call generate-ipq-wifi-package,zyxel_nbg6617,board-zyxel_nbg6617.bin,ZyXEL NBG6617))
 
 $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
diff --git a/package/firmware/ipq-wifi/board-zyxel_nbg6617.bin b/package/firmware/ipq-wifi/board-zyxel_nbg6617.bin
new file mode 100644
index 0000000000..ab4d43e8cb
Binary files /dev/null and b/package/firmware/ipq-wifi/board-zyxel_nbg6617.bin differ
diff --git a/scripts/make-ras.sh b/scripts/make-ras.sh
new file mode 100755
index 0000000000..ccddaa0016
--- /dev/null
+++ b/scripts/make-ras.sh
@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+#
+# --- ZyXEL header format ---
+# Original Version by Benjamin Berg <benjamin@sipsolutions.net>
+#
+# The firmware image prefixed with a header (which is written into the MTD device).
+# The header is one erase block (~64KiB) in size, but the checksum only convers the
+# first 2KiB. Padding is 0xff. All integers are in big-endian.
+#
+# The checksum is always a 16-Bit System V checksum (sum -s) stored in a 32-Bit integer.
+#
+#   4 bytes:  checksum of the rootfs image
+#   4 bytes:  length of the contained rootfs image file (big endian)
+#  32 bytes:  Firmware Version string (NUL terminated, 0xff padded)
+#   4 bytes:  checksum over the header partition (big endian - see below)
+#  32 bytes:  Model (e.g. "NBG6617", NUL termiated, 0xff padded)
+#   4 bytes:  checksum of the kernel partition
+#   4 bytes:  length of the contained kernel image file (big endian)
+#      rest: 0xff padding
+#
+# The checksums are calculated by adding up all bytes and if a 16bit
+# overflow occurs, one is added and the sum is masked to 16 bit:
+#   csum = csum + databyte; if (csum > 0xffff) { csum += 1; csum &= 0xffff };
+# Should the file have an odd number of bytes then the byte len-0x800 is
+# used additionally.
+#
+# The checksum for the header is calculated over the first 2048 bytes with
+# the rootfs image checksum as the placeholder during calculation.
+#
+# The header is padded with 0xff to the erase block size of the device.
+#
+board=""
+version=""
+kernel=""
+rootfs=""
+outfile=""
+err=""
+
+while [ "$1" ]; do
+	case "$1" in
+	"--board")
+		board="$2"
+		shift
+		shift
+		continue
+		;;
+	"--version")
+		version="$2"
+		shift
+		shift
+		continue
+		;;
+	"--kernel")
+		kernel="$2"
+		shift
+		shift
+		continue
+		;;
+	"--rootfs")
+		rootfs="$2"
+		shift
+		shift
+		continue
+		;;
+	"--rootfssize")
+		rootfssize="$2"
+		shift
+		shift
+		continue
+		;;
+	*)
+		if [ ! "$outfile" ]; then
+			outfile=$1
+			shift
+			continue
+		fi
+		;;
+	esac
+done
+
+if [ ! -n "$board" -o ! -n "$version" -o ! -r "$kernel" -o ! -r "$rootfs" -o ! "$rootfssize" -o ! "$outfile" ]; then
+	echo "syntax: $0 [--board ras-boardname] [--version ras-version] [--kernel kernelimage] [--rootfs rootfs] out"
+	exit 1
+fi
+
+rootfs_len=$(wc -c < "$rootfs")
+
+if [ "$rootfs_len" -lt "$rootfssize" ]; then
+	dd if=$rootfs of=$rootfs.new bs=$rootfssize conv=sync
+	mv $rootfs.new $rootfs
+fi
+
+if [ ${#version} -ge 28 ]; then
+	echo "version: '$version' is too long"
+	exit 1
+fi
+
+tmpdir="$( mktemp -d 2> /dev/null )"
+if [ -z "$tmpdir" ]; then
+	# try OSX signature
+	tmpdir="$( mktemp -t 'ubitmp' -d )"
+fi
+
+if [ -z "$tmpdir" ]; then
+	exit 1
+fi
+
+to_be() {
+	local val="$1"
+	local size="$2"
+
+	case "$size" in
+	4)
+		echo $(( "$val" >> 24 | ("$val" & 0xff0000) >> 8 | ("$val" & 0xff00) << 8 | ("$val" & 0xff) << 24 ))
+		;;
+	2)
+		echo $(( "$val" >> 8 | ("$val" & 0xff) << 8))
+		;;
+	esac
+}
+
+checksum_file() {
+	local file=$1
+
+	# ZyXEL seems to use System V sum mode... Now this is classy, who would have thought?!
+	echo $(sum -s ${file} | cut -f1 -d" ")
+}
+
+append_bin() {
+	local val=$1
+	local size=$2
+	local file=$3
+
+	while [ "$size" -ne 0 ]; do
+		printf \\$(printf %o $(("$val" & 0xff)))  >> "$file"
+		val=$(($val >> 8))
+		let size-=1
+	done
+	return
+}
+
+tf=${tmpdir}/out
+pad=$(printf '%0.1s' $(printf "\xff"){1..64})
+
+rootfs_header_file="$tmpdir/rootfs_header"
+rootfs_chksum=$(to_be $(checksum_file ${rootfs}) 4)
+rootfs_len=$(to_be $(wc -c < "$rootfs") 4)
+
+versionpadlen=$(( 32 - ( ${#version} + 1) ))
+
+# 4 bytes:  checksum of the rootfs image
+append_bin "$rootfs_chksum" 4 "$rootfs_header_file"
+# 4 bytes:  length of the contained rootfs image file (big endian)
+append_bin "$rootfs_len" 4 "$rootfs_header_file"
+# 32 bytes:  Firmware Version string (NUL terminated, 0xff padded)
+printf "%s\x00%.*s" "$version" "$versionpadlen" "$pad" >> "$rootfs_header_file"
+
+kernel_header_file="$tmpdir/kernel_header"
+kernel_chksum=$(to_be $(checksum_file ${kernel}) 4)
+kernel_len=$(to_be $(wc -c < "$kernel") 4)
+
+# 4 bytes:  checksum of the kernel image
+append_bin "$kernel_chksum" 4 "$kernel_header_file"
+# 4 bytes:  length of the contained kernel image file (big endian)
+append_bin "$kernel_len" 4 "$kernel_header_file"
+
+board_header_file="$tmpdir/board_header"
+board_file="$tmpdir/board"
+boardpadlen=$(( 64 - ( ${#board} + 1) ))
+# 32 bytes:  Model (e.g. "NBG6617", NUL termiated, 0xff padded)
+printf "%s\x00%.*s" "$board" "$boardpadlen" "$pad" > "$board_file"
+cat "$kernel_header_file" >> "$board_file"
+printf "%.12s" "$pad" >> "$board_file"
+#      rest: 0xff padding
+for i in {1..511}; do
+	printf "%s%s" "$pad" "$pad" >> "$board_file"
+done
+
+tmp_board_file="$tmpdir/tmp_board_file"
+cat "$rootfs_header_file" > "$tmp_board_file"
+
+# The checksum for the header is calculated over the first 2048 bytes with
+# the rootfs image checksum as the placeholder during calculation.
+append_bin "$rootfs_chksum" 4 "$tmp_board_file"
+cat "$board_file" >> "$tmp_board_file"
+
+truncate -s 2048 $tmp_board_file
+board_chksum=$(to_be $(checksum_file ${tmp_board_file}) 4)
+
+# 4 bytes:  checksum over the header partition (big endian)
+append_bin "$board_chksum" 4 "$board_header_file"
+cat "$board_file" >> "$board_header_file"
+
+cat "$rootfs_header_file" "$board_header_file" "$rootfs" "$kernel" > "$outfile"
+
+rm -rf "$tmpdir"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index fcba2aea54..475a8623f7 100755
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -34,6 +34,11 @@ netgear,ex6150v2)
 meraki,mr33)
 	ucidef_set_interface_lan "eth0"
 	;;
+zyxel,nbg6617)
+	ucidef_set_led_wlan "wlan2g" "WLAN2G" "$board:green:wlan2G" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WLAN5G" "$board:green:wlan5G" "phy1tpt"
+	ucidef_set_led_usbport "usb" "USB" "${board}:green:usb" "usb1-port1" "usb2-port1" "usb3-port1" "usb4-port1"
+	;;
 zyxel,wre6606)
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "${boardname}:green:wlan2g" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "${boardname}:green:wlan5g" "phy1tpt"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 03e0c0e16c..5c90ef136f 100755
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -48,6 +48,11 @@ netgear,ex6150v2 |\
 zyxel,wre6606)
 	ucidef_set_interface_lan "eth0"
 	;;
+zyxel,nbg6617)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
+	ucidef_add_switch "switch0" \
+		"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
+	;;
 *)
 	echo "Unsupported hardware. Network interfaces not intialized"
 	;;
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index d89ddf6e57..1d4fd9cd8f 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -146,6 +146,7 @@ case "$FIRMWARE" in
 	openmesh,a62)
 		ath10kcal_extract "0:ART" 4096 12064
 		;;
+	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		ath10kcal_extract "ART" 4096 12064
 		ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
@@ -181,6 +182,7 @@ case "$FIRMWARE" in
 	openmesh,a62)
 		ath10kcal_extract "0:ART" 20480 12064
 		;;
+	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		ath10kcal_extract "ART" 20480 12064
 		ath10kcal_patch_mac_crc $(macaddr_add $(cat /sys/class/net/eth0/address) -1)
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
index 1acd7366c8..44e81ca366 100644
--- a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -8,6 +8,10 @@ preinit_set_mac_address() {
 		mac_lan=$(get_mac_binary "/sys/bus/i2c/devices/0-0050/eeprom" 102)
 		[ -n "$mac_lan" ] && ip link set dev eth0 address "$mac_lan"
 		;;
+	zyxel,nbg6617)
+		base_mac=$(cat /sys/class/net/eth0/address)
+		ip link set dev eth0 address $(macaddr_add "$base_mac" +2)
+		ip link set dev eth1 address $(macaddr_add "$base_mac" +3)
 	esac
 }
 
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh
new file mode 100644
index 0000000000..578ddbe4c4
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/preinit/06_set_preinit_iface_ipq40xx.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set_preinit_iface() {
+	. /lib/functions.sh
+
+	case $(board_name) in
+	asus,rt-ac58u| \
+	avm,fritzbox-4040| \
+	glinet,gl-b1300| \
+	meraki,mr33| \
+	zyxel,nbg6617)
+		ifname=eth0
+		;;
+	*)
+		;;
+	esac
+}
+
+boot_hook_add preinit_main set_preinit_iface
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index 4096e127ea..0e29302465 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -29,6 +29,21 @@ EOF
 	return 0;
 }
 
+zyxel_do_upgrade() {
+	local tar_file="$1"
+
+	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	tar Oxf $tar_file ${board_dir}/kernel | mtd write - kernel
+
+	if [ "$SAVE_CONFIG" -eq 1 ]; then
+		tar Oxf $tar_file ${board_dir}/root | mtd -j "$CONF_TAR" write - rootfs
+	else
+		tar Oxf $tar_file ${board_dir}/root | mtd write - rootfs
+	fi
+}
+
 platform_do_upgrade() {
 	case "$(board_name)" in
 	8dev,jalapeno)
@@ -48,6 +63,9 @@ platform_do_upgrade() {
 		CI_KERNPART="part.safe"
 		nand_do_upgrade "$1"
 		;;
+	zyxel,nbg6617)
+		zyxel_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$ARGV"
 		;;
diff --git a/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
new file mode 100644
index 0000000000..d7f8c5955c
--- /dev/null
+++ b/target/linux/ipq40xx/files-4.14/arch/arm/boot/dts/qcom-ipq4018-nbg6617.dts
@@ -0,0 +1,321 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ */
+
+#include "qcom-ipq4019.dtsi"
+#include "qcom-ipq4019-bus.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "ZyXEL NBG6617";
+	compatible = "zyxel,nbg6617", "qcom,ipq4019";
+
+	chosen {
+		/*
+		 * the vendor u-boot adds root and mtdparts cmdline parameters
+		 * which we don't want... but we have to overwrite them or else
+		 * the kernel will take them at face value.
+		 */
+		bootargs-append = " mtdparts= root=31:13";
+	};
+
+	aliases {
+		led-boot = &power;
+		led-failsafe = &power;
+		led-running = &power;
+		led-upgrade = &power;
+	};
+
+	soc {
+		mdio@90000 {
+			status = "okay";
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		tcsr@1949000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		usb2@60f8800 {
+			status = "okay";
+		};
+
+		serial@78af000 {
+			pinctrl-0 = <&serial_pins>;
+			pinctrl-names = "default";
+			status = "okay";
+		};
+
+		usb3@8af8800 {
+			status = "okay";
+		};
+
+		crypto@8e3a000 {
+			status = "okay";
+		};
+
+		watchdog@b017000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		wlan {
+			label = "wlan";
+			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
+			linux,code = <KEY_RFKILL>;
+			linux,input-type = <EV_SW>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 4 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&led_pins>;
+		pinctrl-names = "default";
+
+		power: power {
+			label = "nbg6617:green:power";
+			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb {
+			label = "nbg6617:green:usb";
+			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan2G {
+			label = "nbg6617:green:wlan2G";
+			gpios = <&tlmm 58 GPIO_ACTIVE_HIGH>;
+		};
+
+		wlan5G {
+			label = "nbg6617:green:wlan5G";
+			gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		wps {
+			label = "nbg6617:green:wps";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&tlmm {
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+	spi_0_pins: spi_0_pinmux {
+		mux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		mux_cs {
+			function = "gpio";
+			pins = "gpio54";
+			drive-strength = <2>;
+			bias-disable;
+			output-low;
+		};
+	};
+	led_pins: led_pinmux  {
+		mux {
+			pins = "gpio0", "gpio1", "gpio3", "gpio5", "gpio58";
+			drive-strength = <0x8>;
+			bias-disable;
+			output-low;
+		};
+	};
+};
+
+&spi_0 { /* BLSP1 QUP1 */
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
+	mx25l25635f@0 {
+		compatible = "mx25l25635f", "jedec,spi-nor";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0>;
+		spi-max-frequency = <24000000>;
+		status = "okay";
+		m25p,fast-read;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition0@0 {
+				label = "SBL1";
+				reg = <0x00000000 0x00040000>;
+				read-only;
+			};
+			partition1@40000 {
+				label = "MIBIB";
+				reg = <0x00040000 0x00020000>;
+				read-only;
+			};
+			partition2@60000 {
+				label = "QSEE";
+				reg = <0x00060000 0x00060000>;
+				read-only;
+			};
+			partition3@c0000 {
+				label = "CDT";
+				reg = <0x000c0000 0x00010000>;
+				read-only;
+			};
+			partition4@d0000 {
+				label = "DDRPARAMS";
+				reg = <0x000d0000 0x00010000>;
+				read-only;
+			};
+			partition5@e0000 {
+				label = "APPSBL"; /* u-boot */
+				reg = <0x000e0000 0x00080000>;
+				/* U-Boot Standalone App "zloader" is located at 0x64000 */
+				read-only;
+			};
+			partition6@160000 {
+				label = "APPSBLENV"; /* u-boot env */
+				reg = <0x00160000 0x00010000>;
+			};
+			partition7@170000 {
+				/* make a backup of this partition! */
+				label = "ART";
+				reg = <0x00170000 0x00010000>;
+				read-only;
+			};
+			partition8@180000 {
+				label = "kernel";
+				reg = <0x00180000 0x00400000>;
+			};
+			partition9@580000 {
+				label = "dualflag";
+				reg = <0x00580000 0x00010000>;
+				read-only;
+			};
+			partition10@590000 {
+				label = "header";
+				reg = <0x00590000 0x00010000>;
+			};
+			partition11@5a0000 {
+				label = "romd";
+				reg = <0x005a0000 0x00100000>;
+				read-only;
+			};
+			partition12@6a0000 {
+				label = "not_root_data";
+				/*
+				 * for some strange reason, someone at ZyXEL
+				 * had the "great" idea to put the rootfs_data
+				 * in front of rootfs... Don't do that!
+				 * As a result this one, full MebiByte remains
+				 * unused.
+				 */
+				reg = <0x006a0000 0x00100000>;
+			};
+			partition13@7a0000 {
+				label = "rootfs";
+				reg = <0x007a0000 0x01860000>;
+			};
+		};
+	};
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+};
+
+&wifi1 {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/image/Makefile b/target/linux/ipq40xx/image/Makefile
index 38600cf979..d1ee1004fd 100644
--- a/target/linux/ipq40xx/image/Makefile
+++ b/target/linux/ipq40xx/image/Makefile
@@ -1,6 +1,8 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
+DEVICE_VARS += RAS_BOARD RAS_ROOTFS_SIZE RAS_VERSION
+
 define Device/Default
 	PROFILES := Default
 	KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
@@ -205,6 +207,26 @@ define Device/qcom_ap-dk04.1-c1
 endef
 TARGET_DEVICES += qcom_ap-dk04.1-c1
 
+define Device/zyxel_nbg6617
+	$(call Device/FitImageLzma)
+	DEVICE_DTS := qcom-ipq4018-nbg6617
+	DEVICE_TITLE := ZyXEL NBG6617
+	ROOTFS_SIZE := 24960k
+	RAS_BOARD := NBG6617
+	RAS_ROOTFS_SIZE := 19840k
+	RAS_VERSION := "$(VERSION_DIST) $(REVISION)"
+	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
+	IMAGES := sysupgrade.bin factory.bin
+#	The ZyXEL firmware allows flashing thru the web-gui only when the rootfs is
+#	at least as large as the one of the initial firmware image (not the current
+#	one on the device). This only applies to the Web-UI, the bootlaoder ignores
+#	this minimum-size. However, the larger image can be flashed both ways.
+	IMAGE/factory.bin := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | make-ras
+	IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | sysupgrade-tar rootfs=$$$$@ | append-metadata
+	DEVICE_PACKAGES := ipq-wifi-zyxel_nbg6617 uboot-envtools
+endef
+TARGET_DEVICES += zyxel_nbg6617
+
 define Device/zyxel_wre6606
 	$(call Device/FitImage)
 	DEVICE_TITLE := ZyXEL WRE6606
diff --git a/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
index 3aa368be83..8066f986a4 100644
--- a/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
+++ b/target/linux/ipq40xx/patches-4.14/069-arm-boot-add-dts-files.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -697,7 +697,19 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+@@ -697,7 +697,20 @@ dtb-$(CONFIG_ARCH_QCOM) += \
  	qcom-apq8074-dragonboard.dtb \
  	qcom-apq8084-ifc6540.dtb \
  	qcom-apq8084-mtp.dtb \
@@ -19,6 +19,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +	qcom-ipq4018-ex6150v2.dtb \
 +	qcom-ipq4018-fritz4040.dtb \
 +	qcom-ipq4018-jalapeno.dtb \
++	qcom-ipq4018-nbg6617.dtb \
 +	qcom-ipq4018-rt-ac58u.dtb \
 +	qcom-ipq4018-wre6606.dtb \
  	qcom-ipq4019-ap.dk01.1-c1.dtb \
diff --git a/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch b/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch
new file mode 100644
index 0000000000..7c513a6ad8
--- /dev/null
+++ b/target/linux/ipq40xx/patches-4.14/303-spi-nor-enable-4B-opcodes-for-mx25l25635f.patch
@@ -0,0 +1,64 @@
+Index: linux-4.14.50/drivers/mtd/spi-nor/spi-nor.c
+===================================================================
+--- linux-4.14.50.orig/drivers/mtd/spi-nor/spi-nor.c
++++ linux-4.14.50/drivers/mtd/spi-nor/spi-nor.c
+@@ -1025,6 +1025,7 @@ static const struct flash_info spi_nor_i
+ 	{ "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
+ 	{ "mx25l12855e", INFO(0xc22618, 0, 64 * 1024, 256, 0) },
+ 	{ "mx25l25635e", INFO(0xc22019, 0, 64 * 1024, 512, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
++	{ "mx25l25635f", INFO(0xc22019, 0, 64 * 1024, 512, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | SPI_NOR_4B_OPCODES) },
+ 	{ "mx25u25635f", INFO(0xc22539, 0, 64 * 1024, 512, SECT_4K | SPI_NOR_4B_OPCODES) },
+ 	{ "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) },
+ 	{ "mx66l51235l", INFO(0xc2201a, 0, 64 * 1024, 1024, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+@@ -1189,11 +1190,12 @@ static const struct flash_info spi_nor_i
+ 	{ },
+ };
+ 
+-static const struct flash_info *spi_nor_read_id(struct spi_nor *nor)
++static const struct flash_info *spi_nor_read_id(struct spi_nor *nor,
++						const char *name)
+ {
+ 	int			tmp;
+ 	u8			id[SPI_NOR_MAX_ID_LEN];
+-	const struct flash_info	*info;
++	const struct flash_info	*info, *first_match = NULL;
+ 
+ 	tmp = nor->read_reg(nor, SPINOR_OP_RDID, id, SPI_NOR_MAX_ID_LEN);
+ 	if (tmp < 0) {
+@@ -1204,10 +1206,16 @@ static const struct flash_info *spi_nor_
+ 	for (tmp = 0; tmp < ARRAY_SIZE(spi_nor_ids) - 1; tmp++) {
+ 		info = &spi_nor_ids[tmp];
+ 		if (info->id_len) {
+-			if (!memcmp(info->id, id, info->id_len))
+-				return &spi_nor_ids[tmp];
++			if (!memcmp(info->id, id, info->id_len)) {
++				if (!name || !strcmp(name, info->name))
++					return info;
++				if (!first_match)
++					first_match = info;
++			}
+ 		}
+ 	}
++	if (first_match)
++		return first_match;
+ 	dev_err(nor->dev, "unrecognized JEDEC id bytes: %02x, %02x, %02x\n",
+ 		id[0], id[1], id[2]);
+ 	return ERR_PTR(-ENODEV);
+@@ -2667,7 +2675,7 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 		info = spi_nor_match_id(name);
+ 	/* Try to auto-detect if chip name wasn't specified or not found */
+ 	if (!info)
+-		info = spi_nor_read_id(nor);
++		info = spi_nor_read_id(nor, NULL);
+ 	if (IS_ERR_OR_NULL(info))
+ 		return -ENOENT;
+ 
+@@ -2678,7 +2686,7 @@ int spi_nor_scan(struct spi_nor *nor, co
+ 	if (name && info->id_len) {
+ 		const struct flash_info *jinfo;
+ 
+-		jinfo = spi_nor_read_id(nor);
++		jinfo = spi_nor_read_id(nor, name);
+ 		if (IS_ERR(jinfo)) {
+ 			return PTR_ERR(jinfo);
+ 		} else if (jinfo != info) {