Hardware
--------
MediaTek MT7621AT
256M DDR3
32M SPI-NOR
MediaTek MT7603 2T2R 802.11n 2.4GHz
MediaTek MT7915 2T2R 802.11ax 5GHz

Not Working
-----------
 - Bluetooth (connected to UART3)

UART
----

UART is located in the lower left corner of the board. Pinout is

0 - 3V3 (don't connect)
1 - RX
2 - TX
3 - GND

Console is 115200 8N1.

Boot
----

1. Connect to the serial console and connect power.

2. Double-press ESC when prompted

3. Set the fdt address

   $ fdt addr $(fdtcontroladdr)

4. Remove the signature node from the control FDT

   $ fdt rm /signature

5. Transfer and boot the OpenWrt initramfs image to the device.
   Make sure to name the file C0A80114.img and have it reachable at
   192.168.1.1/24

   $ tftpboot; bootm

Installation
------------

1. Connect to the booted device at 192.168.1.20 using username/password
   "ubnt".

2. Update the bootloader environment.

   $ fw_setenv devmode TRUE
   $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr);
     fdt rm /signature; bootubnt"
   $ fw_setenv bootcmd "run boot_openwrt"

3. Transfer the OpenWrt sysupgrade image to the device using SCP.

4. Check the mtd partition number for bs / kernel0 / kernel1

   $ cat /proc/mtd

5. Set the bootselect flag to boot from kernel0

   $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4

6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1

   $ dd if=openwrt.bin of=/dev/mtdblock6
   $ dd if=openwrt.bin of=/dev/mtdblock7

7. Reboot the device. It should boot into OpenWrt.

Specifications:

- SoC:      MediaTek MT7621
- Flash:    16 MiB NOR SPI
- RAM:      128 MiB DDR3
- Ethernet: 3x 10/100/1000 Mbps (switched, 2xLAN + WAN)
- WIFI0:    MT7603E 2.4GHz 802.11b/g/n
- WIFI1:    MT7612E 5GHz 802.11ac
- Antennas: 4x external (2 per radio), non-detachable
- LEDs:     Programmable "power" LED (two-coloured, yellow/blue)
            Non-programmable "internet" LED (shows WAN activity)
- Buttons:  Reset

Installation:

Bootloader won't accept any serial input unless "boot_wait" u-boot
environment variable is changed to "on".

Vendor firmware won't accept any serial input until "uart_en" is
set to "1".

Using the https://github.com/acecilia/OpenWRTInvasion exploit you
can gain access to shell to enable these options:

To enable uart keyboard actions - 'nvram set uart_en=1'
To make uboot delay boot work - 'nvram set boot_wait=on'
Set boot delay to 5 - 'nvram set bootdelay=5'

Then run 'nvram commit' to make the changes permanent.

Once in the shell (following the OpenWRTInvasion instructions) you
can then run the following to flash OpenWrt and then reboot:

'cd /tmp; curl https://downloads.openwrt.org/...-sysupgrade.bin
  --output firmware.bin; mtd -e OS1 -r write firmware.bin OS1'

The old bash-based parsing code was way too complex. Replace it with Lua.

Signed-off-by: Martin Weinelt <martin@darmstadt.freifunk.net>

including backport of mtd patches.

The general flash issue (32MB) was discussed here:
https://gist.github.com/dmke/d389bc364b3f73f525076eaee0019dc1
The resulting patch was the following:
http://lists.infradead.org/pipermail/linux-mtd/2016-December/070889.html

Another patch by nbd168 added the required mtd read operations for supporting ZBT-WG3526-32M:
https://github.com/lede-project/source/commit/22d982e#diff-3835f027e16e6416090c1833bc732af3

fixes build after 3ec63b8c

fixes #442

There is no wifi, so there is no bad wifi.

[Matthias Schiffer: rebase onto master]

[Matthias Schiffer: remove patch "ramips: simplify ubnt-erx-sfp device
definition", as it depends on other patches that have not been backported]

Needs more testing, high packet loss at the moment.