Don’t you hate it when a device does not respond anymore? First a quick overview of the device itselves:

  • Share a 3G or 4G mobile connection over a wireless N connection
  • Small, really small device (2.9 x 2.6 x 0.9 in.)
  • Wireless speed upto 150 Mbps
  • Three modes: 3G/4G* Router, WISP Client Router and Travel Router Mode (AP Mode)
  • Flexible power supply. Or via a MiniUSB cable coming from your laptop, or from an adapter with MiniUSB cable
  • Internal antenna

Now in more detail, my version (rev 1.8) contains:

  • The Atheros AR9331 is a highly integrated and cost effective IEEE 802.11n 1×1 2.4 GHz WiFi System-on-Chip (WiSoC) for wireless local area network (WLAN) AP and router platforms.
  • TP-Link_Atheros_AR9331

  • 256Mb DDR SDRAM
  • H1601CG ethernet transformer
  • reset switch
  • 5 status leds
  • USB connector
  • RJ45 connector
  • MiniUSB connector (for power)
  • non populated 4 pins serial connector (3.3 Volt)
  • 2 PCB antenna’s
  • FL032PIF 32-Mbit CMOS 3.0 Volt Flash Memory with SPI bus
  • 3 way switch for configuration mode selection

Now it’s time to open it and find the serial connector to flash OpenWRT.

Opening the case


Opening the device is quite difficult, but needed to access the serial programming pins. Use a blade or better a set of dashboard removal tools. You can buy them at any car parts store. You need to open the top cover of the case.The cover is glued all around except for one side. Start prying the case open on the side where the power connector is situated.

TP-Link_Case_Outside
Then go all around the case and try to break the individual glued points. I did not try to apply heat (which I probably should have done to make it easier). Make sure to do it slow and steady. Then you end up with a cover which can be re-used.
TP-Link_Case_Inside
The arrows show where the cover is glued to the case. I got tired clicking so not all the glue-points have an arrow 😉
TP-LINK_Case_Cover
The red arrow points at the clips which probably will break when you open the case. When you want to re-fit the cover, you should look at the places where the original glue was. It might be needed to remove some material to get it to fit tight again. Use some hot-glue to attach it again in the end. Then when you need to reopen the case again, it will be much easier.

Fitting a programming connector


Online I have ordered a programming module. On dx.com there was a neat FT232RL USB to Serial Port Adapter Module for only €4,98. This is the same price as a separate FT232RL but then with a complete PCB and connectors. Now I hope it is an original FT chip and not a fake one. On the image it looks real. The fake one has the text printed on it, the real one has laser engraving. The FT module supports 5V and 3.3V (which I need for the router).
FT232RL-USB-to-Serial-Port-Adapter-Module
Some images of the PCB zoomed in:
TP-Link_PCB_TopSideTP-Link_PCB_BotSide

Connector P1:
P1-1: TXD <-> RXD (grey)
P1-2: RXD <-> TXD (white)
P1-3: GND <-> GND (black)
P1-4: VCC Do not connect!

On your ubuntu laptop install tftp:
sudo apt-get install tftpd-hpa tftp
sudo apt-get install xinetd tftpd tftp
cd /etc/xinetd.d
sudo vi tftp

paste:
service tftp
{
protocol = udp
port = 69
socket_type = dgram
wait = yes
user = nobody
server = /usr/sbin/in.tftpd
server_args = /var/lib/tftpboot
disable = no
}

Create a folder /var/lib/tftpboot this should match whatever you gave in server_args. mostly it will be /var/lib/tftpboot

sudo chmod -R 777 /var/lib/tftpboot
sudo chown -R nobody /var/lib/tftpboot

Restart the xinetd service:
sudo /etc/init.d/xinetd restart

Download the firmware from:
Index of /attitude_adjustment/12.09/ar71xx/generic/
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
When you dont know how to choose between squashfs and jffs2, you read the article http://wiki.openwrt.org/doc/howto/generic.failsafe. After reading that you will decide to pick the squashfs version, it has support for failsafe operation.

sudo cp /home/user/Desktop/Images/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin /var/lib/tftpboot/

chmod the file there so it can be downloaded.
sudo chmod 666 /var/lib/tftpboot/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

To test the connection do:
sudo tftp localhost
get openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
q

Open a terminal connection (gtkterm) the virtual serial port (/dev/ttyUSB0) with BaudRate 115200. Then when it says autobooting in 1 second, you need to enter tpl. These should be entered VERY fast or you mis the window. Once you did this the U-Boot terminal shows:
hornet>

TP-Link_FirmwareBoot

hornet> setenv ipaddr 192.168.2.1
hornet> setenv serverip 192.168.2.11

hornet> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
ipaddr=192.168.1.1
serverip=192.168.1.2

Environment size: 358/65532 bytes

hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

hornet> erase 0x9f020000 +0x3c0000

hornet> cp.b 0x80000000 0x9f020000 0x3c0000

hornet> bootm 9f020000

root@OpenWrt:/# ifconfig

When you do not have an internet connection which is in the range 192.168.1.x, you need to reconfigure the network config to download packages.

vi /etc/config/network
config interface ‘loopback’
option ifname ‘lo’
option proto ‘static’
option ipaddr ‘127.0.0.1’
option netmask ‘255.0.0.0’

config globals ‘globals’
option ula_prefix ‘fd83:d9c6:9590::/48’

config interface ‘lan’
option ifname ‘eth0’
option force_link ‘1’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘192.168.168.98
option netmask ‘255.255.255.0’
option gateway ‘192.168.168.254’
option ip6assign ’60’

vi /etc/resolv.conf
search lan
nameserver 192.168.2.254

To get the network connection running according this new config do:

You need to press enter to get the console back.

The result is an AP which does not have any GUI. This can be fixed by installing LuCI (http://wiki.openwrt.org/doc/howto/luci.essentials). The commands needed are:
opkg update
opkg install luci
or
opkg install luci-ssl # enable https for LuCI

You can also download the packages from the internet. Look at the config file /etc/opkg.conf. There you will find links to different locations where ipkg files kan be found.
In my case I need the files downloaded from:
Index of /snapshots/trunk/ar71xx/generic/packages/luci/
I still did not quite find out how this works. When looking at the link, there is loads of packages and I do not know where to choose from. To be continued (or not)?
The web software uhttpd is a dependency which is installed by LuCI 🙂 All opkg installed components are disabled by default. Want to enable it? Do It Yourself with:
/etc/init.d/uhttpd start
/etc/init.d/uhttpd enable # Makes the starting persistent after a reboot.

Now you should be able to connect to the webinterface by visiting 192.168.1.1.
Optionally you can install native language support. The UI is translated by an active community.

Next step is to have the TP-Link running in a AP client bridged mode.

4 thoughts on “Flash bricked TP_Link LT-MR3020 wireless router

  • 2016/09/27 at 13:09
    Permalink

    I did everything like in tutorial and it worked ok, but now the router no longer boots Linux, and I can not connect to the serial.
    What can be the reason?

    Reply
  • 2016/12/18 at 12:56
    Permalink

    Just to share my nightmare … Info shared here is good, but not all the way in my case. USB serial use 128000 and not 115200 console speed. I lost a lot of time, because i could not find info about it. It’s same model M3020 but version 1.9. Hope it will help others.

    Reply
  • 2017/01/11 at 19:37
    Permalink

    When I try to type in tpl, nothing happens. It’s like it does not accept any input. I tried on Windows like described above and with Linux and gtkterm – no input possible. What can be wrong?

    Reply
    • 2017/01/12 at 09:00
      Permalink

      The timing on typing tpl is quite critical. When I needed to do it I had to try it like 6 or 7 times before I got the perfect moment to type it. You also should type the 3 letters really quick.

      Maybe the device is defective of there is something wrong with your usb->serial device. Try to ensure that typing at other moments does produce input to the device.

      Do you see the text apearing on your terminal? Did you set the baudrate correctly?

      Reply

Leave a Reply