Flash bricked TP_Link LT-MR3020 wireless router

Don’t you hate it when a device does not respond anymore? First a quick overview of the device itselves:

• Share a 3G or 4G mobile connection over a wireless N connection
• Small, really small device (2.9 x 2.6 x 0.9 in.)
• Wireless speed upto 150 Mbps
• Three modes: 3G/4G* Router, WISP Client Router and Travel Router Mode (AP Mode)
• Flexible power supply. Or via a MiniUSB cable coming from your laptop, or from an adapter with MiniUSB cable
• Internal antenna

Now in more detail, my version (rev 1.8) contains:

• The Atheros AR9331 is a highly integrated and cost effective IEEE 802.11n 1×1 2.4 GHz WiFi System-on-Chip (WiSoC) for wireless local area network (WLAN) AP and router platforms.




• 256Mb DDR SDRAM
• H1601CG ethernet transformer
• reset switch
• 5 status leds
• USB connector
• RJ45 connector
• MiniUSB connector (for power)

–

• non populated 4 pins serial connector (3.3 Volt)
• 2 PCB antenna’s
• FL032PIF 32-Mbit CMOS 3.0 Volt Flash Memory with SPI bus
• 3 way switch for configuration mode selection

Now it’s time to open it and find the serial connector to flash OpenWRT.

---

---

Opening the case

Opening the device is quite difficult, but needed to access the serial programming pins. Use a blade or better a set of dashboard removal tools. You can buy them at any car parts store. You need to open the top cover of the case.The cover is glued all around except for one side. Start prying the case open on the side where the power connector is situated.

Then go all around the case and try to break the individual glued points. I did not try to apply heat (which I probably should have done to make it easier). Make sure to do it slow and steady. Then you end up with a cover which can be re-used.

The arrows show where the cover is glued to the case. I got tired clicking so not all the glue-points have an arrow 😉

The red arrow points at the clips which probably will break when you open the case. When you want to re-fit the cover, you should look at the places where the original glue was. It might be needed to remove some material to get it to fit tight again. Use some hot-glue to attach it again in the end. Then when you need to reopen the case again, it will be much easier.

Fitting a programming connector

Online I have ordered a programming module. On dx.com there was a neat FT232RL USB to Serial Port Adapter Module for only €4,98. This is the same price as a separate FT232RL but then with a complete PCB and connectors. Now I hope it is an original FT chip and not a fake one. On the image it looks real. The fake one has the text printed on it, the real one has laser engraving. The FT module supports 5V and 3.3V (which I need for the router).

Some images of the PCB zoomed in:

You need to solder a connector onto the PCB and also add a resistor between the outer two pins (VCC and TXD) like shown in the picture below:

---

---

Connector P1:
P1-1: TXD <-> RXD (grey)
P1-2: RXD <-> TXD (white)
P1-3: GND <-> GND (black)
P1-4: VCC Do not connect!

On your ubuntu laptop install tftp:
sudo apt-get install tftpd-hpa tftp
sudo apt-get install xinetd tftpd tftp
cd /etc/xinetd.d
sudo vi tftp

paste:
service tftp
{
protocol = udp
port = 69
socket_type = dgram
wait = yes
user = nobody
server = /usr/sbin/in.tftpd
server_args = /var/lib/tftpboot
disable = no
}

Create a folder /var/lib/tftpboot this should match whatever you gave in server_args. mostly it will be /var/lib/tftpboot

sudo chmod -R 777 /var/lib/tftpboot
sudo chown -R nobody /var/lib/tftpboot

Restart the xinetd service:
sudo /etc/init.d/xinetd restart

Download the firmware from:
Index of /attitude_adjustment/12.09/ar71xx/generic/
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
When you dont know how to choose between squashfs and jffs2, you read the article http://wiki.openwrt.org/doc/howto/generic.failsafe. After reading that you will decide to pick the squashfs version, it has support for failsafe operation.

sudo cp /home/user/Desktop/Images/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin /var/lib/tftpboot/

chmod the file there so it can be downloaded.
sudo chmod 666 /var/lib/tftpboot/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

To test the connection do:
sudo tftp localhost
get openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
q

Open a terminal connection (gtkterm) the virtual serial port (/dev/ttyUSB0) with BaudRate 115200. Then when it says autobooting in 1 second, you need to enter tpl. These should be entered VERY fast or you mis the window. Once you did this the U-Boot terminal shows:
hornet>

hornet> setenv ipaddr 192.168.2.1
hornet> setenv serverip 192.168.2.11

hornet> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
ipaddr=192.168.1.1
serverip=192.168.1.2

Environment size: 358/65532 bytes

hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

Using eth1 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)

hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000
61
Erased 60 sectors

hornet> cp.b 0x80000000 0x9f020000 0x3c0000

Copy to Flash... write addr: 9f020000
done

hornet> bootm 9f020000

## Booting image at 9f020000 ...
Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Linux version 3.18.18 (thepeople@trabant) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46421) ) #1 Sun Jul 19 22:30:03 CEST 2015
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Atheros AR9330 rev 1
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x01ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x00000000-0x01ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=TL-MR3020 console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 28260K/32768K available (2650K kernel code, 133K rwdata, 548K rodata, 244K init, 194K bss, 4508K reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:83
[ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.100000] NET: Registered protocol family 16
[ 0.100000] MIPS: machine is TP-LINK TL-MR3020
[ 0.380000] Switched to clocksource MIPS
[ 0.380000] NET: Registered protocol family 2
[ 0.390000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.390000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.390000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.400000] TCP: reno registered
[ 0.400000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.410000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.420000] NET: Registered protocol family 1
[ 0.420000] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.440000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.440000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.450000] msgmni has been set to 55
[ 0.450000] io scheduler noop registered
[ 0.460000] io scheduler deadline registered (default)
[ 0.460000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.470000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a Ar933X UART
[ 0.480000] console [ttyATH0] enabled
[ 0.480000] console [ttyATH0] enabled
[ 0.490000] bootconsole [early0] disabled
[ 0.490000] bootconsole [early0] disabled
[ 0.500000] m25p80 spi0.0: found s25sl032p, expected m25p80
[ 0.500000] m25p80 spi0.0: s25sl032p (4096 Kbytes)
[ 0.510000] 5 tp-link partitions found on MTD device spi0.0
[ 0.510000] Creating 5 MTD partitions on "spi0.0":
[ 0.520000] 0x000000000000-0x000000020000 : "u-boot"
[ 0.520000] 0x000000020000-0x000000145804 : "kernel"
[ 0.530000] 0x000000145804-0x0000003f0000 : "rootfs"
[ 0.530000] mtd: device 2 (rootfs) set to be root filesystem
[ 0.540000] 1 squashfs-split partitions found on MTD device rootfs
[ 0.540000] 0x000000350000-0x0000003f0000 : "rootfs_data"
[ 0.550000] 0x0000003f0000-0x000000400000 : "art"
[ 0.550000] 0x000000020000-0x0000003f0000 : "firmware"
[ 0.600000] libphy: ag71xx_mdio: probed
[ 1.190000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[ 1.200000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 1.200000] TCP: cubic registered
[ 1.200000] NET: Registered protocol family 17
[ 1.210000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 1.220000] Bridge firewalling registered
[ 1.230000] 8021q: 802.1Q VLAN Support v1.8
[ 1.240000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 1.250000] Freeing unused kernel memory: 244K (803a3000 - 803e0000)
[ 2.490000] init: Console is alive
[ 2.490000] init: - watchdog -
[ 4.050000] usbcore: registered new interface driver usbfs
[ 4.050000] usbcore: registered new interface driver hub
[ 4.060000] usbcore: registered new device driver usb
[ 4.070000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 4.070000] ehci-platform: EHCI generic platform driver
[ 4.080000] ehci-platform ehci-platform: EHCI Host Controller
[ 4.080000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[ 4.090000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[ 4.120000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[ 4.120000] hub 1-0:1.0: USB hub found
[ 4.120000] hub 1-0:1.0: 1 port detected
[ 4.130000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 4.140000] ohci-platform: OHCI generic platform driver
[ 4.520000] init: - preinit -
[ 5.310000] random: procd urandom read with 8 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 7.280000] eth0: link up (100Mbps/Full duplex)
[ 8.450000] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[ 8.490000] eth0: link down
[ 8.500000] procd: - early -
[ 8.510000] procd: - watchdog -
[ 9.240000] procd: - ubus -
[ 10.260000] procd: - init -
Please press Enter to activate this console.
[ 11.230000] NET: Registered protocol family 10
[ 11.240000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 11.260000] Loading modules backported from Linux version master-2015-06-22-0-g4732c92
[ 11.270000] Backport generated by backports.git backports-20150626-0-gc1a4168
[ 11.280000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 11.300000] nf_conntrack version 0.5.0 (445 buckets, 1780 max)
[ 11.350000] xt_time: kernel timezone is -0000
[ 11.390000] cfg80211: Calling CRDA to update world regulatory domain
[ 11.420000] cfg80211: World regulatory domain updated:
[ 11.420000] cfg80211: DFS Master region: unset
[ 11.420000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[ 11.430000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[ 11.440000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[ 11.450000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[ 11.460000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[ 11.470000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[ 11.480000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[ 11.480000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[ 11.490000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[ 11.590000] PPP generic driver version 2.4.2
[ 11.590000] NET: Registered protocol family 24
[ 11.680000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
[ 11.680000] cfg80211: Calling CRDA for country: US
[ 11.700000] cfg80211: Regulatory domain changed to country: US
[ 11.700000] cfg80211: DFS Master region: FCC
[ 11.700000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[ 11.710000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[ 11.720000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 1700 mBm), (N/A)
[ 11.730000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (0 s)
[ 11.740000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2300 mBm), (0 s)
[ 11.750000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[ 11.760000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[ 20.060000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 20.090000] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 20.090000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[ 23.210000] jffs2: notice: (946) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 24.830000] device eth0 entered promiscuous mode
[ 24.870000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 27.560000] eth0: link up (100Mbps/Full duplex)
[ 27.560000] br-lan: port 1(eth0) entered forwarding state
[ 27.570000] br-lan: port 1(eth0) entered forwarding state
[ 27.580000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 29.570000] br-lan: port 1(eth0) entered forwarding state
[ 80.650000] random: nonblocking pool is initialized

BusyBox v1.23.2 (2015-07-19 22:16:29 CEST) built-in shell (ash)

_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
CHAOS CALMER (Bleeding Edge, r46421)
-----------------------------------------------------
* 1 1/2 oz Gin Shake with a glassful
* 1/4 oz Triple Sec of broken ice and pour
* 3/4 oz Lime Juice unstrained into a goblet.
* 1 1/2 oz Orange Juice
* 1 tsp. Grenadine Syrup
-----------------------------------------------------

root@OpenWrt:/# ifconfig

br-lan Link encap:Ethernet HWaddr 64:66:B3:D1:2D:60
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::6666:b3ff:fed1:2d60/64 Scope:Link
inet6 addr: fdb2:56e6:9878::1/60 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41 errors:0 dropped:0 overruns:0 frame:0
TX packets:59 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5480 (5.3 KiB) TX bytes:5530 (5.4 KiB)

eth0 Link encap:Ethernet HWaddr 64:66:B3:D1:2D:60
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:78 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9288 (9.0 KiB) TX bytes:2464 (2.4 KiB)
Interrupt:4

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:640 errors:0 dropped:0 overruns:0 frame:0
TX packets:640 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:43688 (42.6 KiB) TX bytes:43688 (42.6 KiB)

root@OpenWrt:/#


When you do not have an internet connection which is in the range 192.168.1.x, you need to reconfigure the network config to download packages.

vi /etc/config/network
config interface ‘loopback’
option ifname ‘lo’
option proto ‘static’
option ipaddr ‘127.0.0.1’
option netmask ‘255.0.0.0’

config globals ‘globals’
option ula_prefix ‘fd83:d9c6:9590::/48’

config interface ‘lan’
option ifname ‘eth0’
option force_link ‘1’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘192.168.168.98‘
option netmask ‘255.255.255.0’
option gateway ‘192.168.168.254’
option ip6assign ’60’

vi /etc/resolv.conf
search lan
nameserver 192.168.2.254

To get the network connection running according this new config do:

/etc/init.d/network reload
[ 173.030000] br-lan: port 1(eth0) entered disabled state
[ 173.030000] device eth0 left promiscuous mode
[ 173.040000] br-lan: port 1(eth0) entered disabled state
[ 173.050000] eth0: link down
[ 173.050000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 173.060000] device eth0 entered promiscuous mode
[ 173.090000] br-lan: port 1(eth0) entered forwarding state
[ 173.090000] br-lan: port 1(eth0) entered forwarding state
'radio0' is disabled
'radio0' is disabled
root@OpenWrt:/etc/config# [ 4673.720000] eth0: link up (100Mbps/Full duplex)
[ 175.090000] br-lan: port 1(eth0) entered forwarding state

You need to press enter to get the console back.

The result is an AP which does not have any GUI. This can be fixed by installing LuCI (http://wiki.openwrt.org/doc/howto/luci.essentials). The commands needed are:
opkg update
opkg install luci
or
opkg install luci-ssl # enable https for LuCI

---

---

You can also download the packages from the internet. Look at the config file /etc/opkg.conf. There you will find links to different locations where ipkg files kan be found.
In my case I need the files downloaded from:
Index of /snapshots/trunk/ar71xx/generic/packages/luci/
I still did not quite find out how this works. When looking at the link, there is loads of packages and I do not know where to choose from. To be continued (or not)?
The web software uhttpd is a dependency which is installed by LuCI 🙂 All opkg installed components are disabled by default. Want to enable it? Do It Yourself with:
/etc/init.d/uhttpd start
/etc/init.d/uhttpd enable # Makes the starting persistent after a reboot.

Now you should be able to connect to the webinterface by visiting 192.168.1.1.
Optionally you can install native language support. The UI is translated by an active community.

Next step is to have the TP-Link running in a AP client bridged mode.