You are here / / Table of Hardware / TP-Link / TP-Link TL-MR3020

TP-Link TL-MR3020
This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date
and secure OpenWrt version (18.06 or later) onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure
and reliable operation.
This means that even setting a password or changing simple network settings might not be
possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices
what you can do now.

2) OpenWrt support for this device will end after 2019.

19.07 will be the last official build for 4/32 devices. After 19.07, no further OpenWrt images
will be built for 4/32 devices. See OpenWrt on 4/32 devices what you can do now.

See also TL-MR3040 and TL-WR703N or TP-Link TL-MR10U, TP-Link TL-MR11U, TP-Link TL-
MR12U and TP-Link TL-MR13U.

Note: Many of these routers are marketed as a “3G travel router” but none actually include a 3G
modem - the marketing term rather means that the OEM firmware supports a certain range of
3G/4G modems to be externally connected to USB because it contains drivers for those USB
modems! Ignore that, because with OpenWrt ANY router with USB supports 3G/4G hardware …

The router is powered through a mini-USB socket stub (5V) and comes with a USB power
adapter. hardware revision 3.20 is powered through micro-USB socket.
Supported Hardware Versions

Model Launch
Version Date Supported since

v1.0 2011- r29651 (https://dev.openwrt.org/changeset/29651)

12

v1.4 2012- r29763 (https://dev.openwrt.org/changeset/29763), probably earlier

01

v1.6 2012- r30753 (https://dev.openwrt.org/changeset/30753), probably earlier

03

v1.7 2012- 12.09-RC1, r32786 (https://dev.openwrt.org/changeset/32786)

05

v1.8 ?? 12.09-RC1
Model Launch
Version Date Supported since

v1.9 ?? 14.07

v3.0 ?? 18.06.1 snapshots

(https://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/), comm
6bbb2202551be394fead2efd99eb946f846fc63d (https://git.openwrt.org/?
p=openwrt/openwrt.git;a=commit;h=6bbb2202551be394fead2efd99eb946f84

The current release OEM source code available at: http://www.tp-

link.com/resources/gpl/150Router.rar (http://www.tp-link.com/resources/gpl/150Router.rar)

Hardware Highlights
Model Version SoC CPU Flash RAM WLAN WLAN2.4 WLAN5.0 100M
MHz MB MB Hardware ports

TL- v1 Atheros 400 4 32 Atheros b/g/n - 1

MR3020 AR9331 AR9331

TL- v3 MediaTek 575 8 64 MediaTek b/g/n - 1

MR3020 MT7628NN MT7628NN

Tiny form factor

5.7 cm x 5.7 cm PCB
6.7 cm x 7.4 cm x 2.2 cm case

Power consumption
Input voltage: The router will function correctly when powered with voltages as low as 3.3 Volts
(determined experimentally) instead of 5V USB-Power. Thus, it can be powered directly from one
single Li-Ion battery (which usually starts fully charged at 4.2V and has a nominal voltage of 3.7)
without the need for an external 5V adapter.

This router is standardly powered via USB at 5V. The voltage regulators' input voltage should be
at least between 3.7V - 5.5V, but not over 5.5V. The device will get damaged at too high
voltages*. Maximum current draw at 5V is 255mA (Active Download + LAN () + WLAN () +
USBboot), average current draw with WiFi is 125mA, idle is 68mA. Hence the average router
power consumption is 0.6W, which is incredibly low.

Power consumption will be higher if a USB device is attached to its USB port! More information
and a rough diagram here Interesting webpage with more data about power consumption and so
on (https://apollo.open-resource.org/lab:argus)

Installation
↓ Version Supported Firmware OpenWrt Install URL
Model Current
Rel

TL- v1 17.01.7 https://downloads.openwrt.org/releases/17.01.7/targets/ar71x

MR3020 17.01.7-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
(https://downloads.openwrt.org/releases/17.01.7/targets/ar71
17.01.7-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin)

TL- v3 22.03.2 https://downloads.openwrt.org/releases/22.03.2/targets/ramip

MR3020 22.03.2-ramips-mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recov
(https://downloads.openwrt.org/releases/22.03.2/targets/rami
22.03.2-ramips-mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recov

Method Using Web GUI (Recommended)

Web GUI () upload has been confirmed to work with v1.0, v1.4, v1.6, v1.7, v1.8 and 1.9 hardware
revisions and requires no serial or TFTP () access unless something goes wrong.

Log in to the router's web GUI () (default login/password: admin / admin) and flash with
openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware image like a regular
firmware update.

Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed
with proceed with basic configuration as with any fresh OpenWrt install.
See forum (https://forum.openwrt.org/viewtopic.php?pid=154203#p154203) if you encounter
problems.

Method using TFTP (Experts)

At least for model v3 it is possible to upload the OpenWrt image via TFTP () without using the
serial console. See the Bootloader Recovery for details.

For older models it may be necessary to use the manual TFTP () upload method, which requires
a serial console connection (see below).

Manual Method Using Serial Console and TFTP

(Experts)
To install OpenWrt from the U-Boot console, you need to install a TFTP () server on your
computer (tftp-hpa is recommended).

Then download OpenWrt factory image to /srv/tftp (for example), and execute the TFTP () server
by typing tftpd -l -s /srv/tftp.

Connect the TL-MR3020 using a serial console and power up the TL-MR3020.

After a 1-2 seconds it shows Autobooting in 1 seconds, when displaying this enter tpl
immediately.

Using default environment

In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands:
 hornet> setenv ipaddr <device-ip, eg. 192.168.1.111>
hornet> setenv serverip <server-ip, eg. 192.168.1.100>
hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-f
actory.bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000

61
Erased 60 sectors
hornet> cp.b 0x80000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000

done
hornet> bootm 9f020000

OEM Mass Flashing

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell
script to automate it:
 #!/bin/bash

# Pass the firmware file to be flashed as the first parameter.

#
# The second curl call will time out, but it's expected. Once the
# script exits you can unplug the ethernet cable and proceed to the
# next router, but KEEP each router ON POWER until the new image is
# fully written! When flashing is done the router automatically
# reboots (as shown by all the leds flashing once).

curl \
--user admin:admin \
--user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100
101 Firefox/12.0' \
--referer 'http://192.168.0.254/userRpm/SoftwareUpgradeRpm.htm' \
--form "Filename=@$1" -F 'Upgrade=Upgrade' \
http://192.168.0.254/incoming/Firmware.htm > ans.html
# > /dev/null

sleep 1

session_id=$(sed -n 's/var session_id = \"\(.*\)\".*/\1/p' ans.html)

curl \
--max-time 2 \
--user admin:admin \
--user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100
101 Firefox/12.0' \
--referer 'http://192.168.0.254/incoming/Firmware.htm' \
http://192.168.0.254/userRpm/FirmwareUpdateTemp.htm?session_id=$session_
id > /dev/null

Install Snapshot Image

If you install openwrt from trunk, the firmware image doesn't include LuCi. You need configure
wireless network from telnet to install Luci. You will need already working internet access.

For this example:

Main router:

Ip: '192.168.2.1'
Ssid: 'Example-network'
Bssid: '11:11:11:11:11:11'
Encryption: 'WPA2 - PSK'
Key: 'PaSSworD'
Channel: '9'

( You need fill these by your network properities )

Terminal program:
 Putty

After install trunk image wait few minutes then recycle power router and set your computer ip
address to:

ip: 192.168.1.2
subnet: 255.255.255.0
gateway: 192.168.1.1

Start your terminal and connect 192.168.1.1 via telnet ( port 23 ). Right now LAN () INTERFACE
include wireless too. We need to set wireless to WAN () interface. Change wireless configuration
below example.

vi /etc/config/wireless

config wifi-device radio0

option type mac80211
option channel 9
option hwmode 11ng
option path 'platform/ar933x_wmac'
option htmode HT20
list ht_capab SHORT-GI-20
list ht_capab SHORT-GI-40
list ht_capab RX-STBC1
list ht_capab DSSS_CCK-40
option disabled 0
option txpower 27

config wifi-iface
option device radio0
option network wan
option mode sta
option ssid Example-network
option encryption psk2
option bssid 11:11:11:11:11:11
option key PaSSworD

Wireless setup completed now we need to get ip WAN () interface via main router dhcp server.
Set your network config like below example.
 vi /etc/config/network

config interface 'loopback'

option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'

option ula_prefix 'fd48:931d:0f42::/48'

config interface 'lan'

option ifname 'eth0'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'

option proto 'dhcp'
option _orig_ifname radio0
option _orig_bridge false

Reboot your router

reboot

Your terminal session will be closed. You need reconnect to router.

Test your router: If your router is properly connected to the internet you should get something
like the below lines:

ping -c3 www.google.com

PING www.google.com (xxx.xxx.xxx.xxx): 56 data bytes
64 bytes from xxx.xxx.xxx.xxx: seq=0 ttl=52 time=88.295 ms
64 bytes from xxx.xxx.xxx.xxx: seq=1 ttl=52 time=87.783 ms
64 bytes from xxx.xxx.xxx.xxx: seq=2 ttl=52 time=87.503 ms

--- www.google.com ping statistics ---

3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 87.503/87.860/88.295 ms

Now you can install Luci and enable it by below commands:

opkg update
opkg install luci
/etc/init.d/uhttpd enable
/etc/init.d/uhttpd start

Now you can access LuCi interface by 192.168.1.1 with your browser.
How To Enable Reset Functionality
By default reset button won't work , as it is only assigned for WPS(in present source code Chaos
Calmer 15.0)

*method 1 :

You can enable that functionality , by manually write script in /etc/hot

plog.d/button/buttons file, where you can check the $BUTTON type and accor
ding to that write action for reset.

*method 2 :

change in
file 1 : openwrt/build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-a
r71xx_generic/linux-3.18.36/arch/mips/ath79/mach-tl-mr3020.c
OR
file 2 : openwrt/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-m
r3020.c

change wps to reset

#define TL_MR3020_GPIO_BTN_RESET 11
static struct gpio_keys_button tl_mr3020_gpio_keys[] __initdata = {
{
.desc = "Reset button",
.type = EV_KEY,
.code = KEY_RESTART,
.debounce_interval = TL_MR3020_KEYS_DEBOUNCE_INTERVAL,
.gpio = TL_MR3020_GPIO_BTN_RESET,
.active_low = 0,
},

TRAC ticket has been raised at https://dev.openwrt.org/ticket/22951

(https://dev.openwrt.org/ticket/22951) (will delete this line after changes are made in source
code)

Failsafe Mode
Power on the TL-MR3020
When the WPS button starts to blink:
on AA (Attitude Adjustment / 12.09) push the WPS button;
on BB (Breaking Barrier / trunk) move the sliding switch quickly from one side to the
other.
on CC (Chaos Calmer) ??? not sure try any switches or buttons ??? repeatedly is
fine. 12/11/2015: repeatdly pushing the WPS worked.
Do this until the WPS button starts blinking faster.
The device is now in Failsafe-Mode
Connect the TL-MR3020 to your computer via ethernet
Follow further instructions at: failsafe

Downgrade Attitute Adjustment from Trunk

Downgraded wrong image ( jff2 instead of squashfs ) cause cant get ip or connect to luci.
Failsafe mode still working but firstboot command wont work because it is already on working.
You can upload correct firmware and write it with mtd command but failsafe mode can't connect
internet. You need to local tftp server to get firmware.

Set your pc ip 192.168.1.10/24 and gateway 192.168.1.1. Download mongoose http server
(http://code.google.com/p/mongoose/) and correct firmware same folder and start mongoose.
It will host all files in his path ( if you start it from downloads folder it will host all files in
downloads folder )

now we can get firmware via failsafe telnet:

wget http://192.168.1.10:8080/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs
-factory.bin
mtd -r write /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
firmware
Writing from /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
to firmware ...
Rebooting ...
/bin/sh: /sbin/reboot: Input/output error

DONT DO ANYTHING. Just wait and router reboot itself. wait few minutes and you will able to
reach Luci via 192.168.1.1.

Restoring Original Firmware

→ generic.uninstall
Warning!
This section describes actions that might damage your device or
firmware. Proceed with care!

With the TL-MR3020 router, there is a catch: the stock firmware is obtained from the OEM:
http://www.tplink.com/en/support/download/?model=TL-MR3020
(http://www.tplink.com/en/support/download/?model=TL-MR3020)

in case the file name of this firmware file does not contain the word “boot” in it, you can
simply revert back to original firmware
in case the file name of this firmware file does contain the word “boot” in it, you need to
cut off parts of the image file before flashing it:

An example of an image file with the word “boot” in it is

mr3020nv1_en_3_17_2_up_boot(140408).bin .

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:
 dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware
(if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade:

sysupgrade /tmp/tplink.bin

Or you use the mtd method:

mtd -r write /tmp/tplink.bin firmware

It is also possible to revert to the stock firmware using the method with tftp described in “Manual
Method Using Serial Console and TFTP () (Experts)”. (you still need the firmware images without
the boot part).

OEM TP-Link firmware for the TL-MR3020 with the boot part removed to revert to the original
OEM firmware:

TL-MR3020 V1 http://www.friedzombie.com/tplink-stripped-firmware
(http://www.friedzombie.com/tplink-stripped-firmware) search for TL-MR3020-V1

Bootloader Recovery
This is confirmed working on a MR3020 v3. You can grab a stock TP-Link that's been snipped of
its header, or grab an OpenWRT image with recovery in its name such as “openwrt-ramips-
mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recovery.bin”

Grab Tftpd64 https://archive.codeplex.com/?p=tftpd64 (https://archive.codeplex.com/?

p=tftpd64) or any other TFTP () server of your choice.
Set your ethernet IP () to 192.168.0.225/24 , the MR3020 will show up at 192.168.0.2
Rename your recovery bin to tp_recovery.bin and point Tftpd64 to the directory your
leaving the file in.
Plug in your ethernet cable.
Hold down the WPS button and power the device on, the 2nd LED will fast trigger after a
moment, release button, the TFTP () server should report a file being downloaded.
Wait until it starts slow flashing and then reboots.

You're back to stock !

Basic Configuration
Since this part is identical to the one recommended for generic devices, see Basic configuration.

Original Flash Layout

Please read the article flash.layout for a better understanding. It contains a couple of
explanations. Then let's have a quick view at flash layout of this particular device:

TP-Link MR3020 Flash Layout stock firmware

Layer0 spi0.0: 4096KiB

Layer1 mtd0 mtd1 mtd2 mtd3 mtd4

Size in KiB 128KiB 1024KiB 2816 KiB 64KiB 64KiB

Name u-boot kernel rootfs config art

mountpoint none none / none none

filesystem none none SquashFS none none

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt,
wireless won't come up anymore.

Hardware

Hardware summary

IC Info / Datasheet

Chipset AR9331 https://wikidevi.com/wiki/Atheros_AR9331

(WiSoC) (https://wikidevi.com/wiki/Atheros_AR9331)

Flash Spansion http://www.spansion.com/Support/Datasheets/S25FL032P_00.pdf

ROM S25FL032P (http://www.spansion.com/Support/Datasheets/S25FL032P_00.pdf)

SDRAM Windbond http://www.winbond.com/NR/rdonlyres/11505884-F632-41F9-9438-

W9425G6JH A3EC025FEAED/0/W9425G6JH.pdf
(http://www.winbond.com/NR/rdonlyres/11505884-F632-41F9-
9438-A3EC025FEAED/0/W9425G6JH.pdf)

Zentel
A3S56D40FTP-
G5

Opening the Case

The case consists of two parts: a white base and a gray lid. The lid has two snap hinges, one
right above the mini USB connector and one on the opposite side about 10 mm left of the “TP-
LINK” logo. The lid is additionally glued in place on the underside on all four sides. You can try to
pry it open with a thin but very stable blade tool. Start above the ethernet port where the case is
not glued, and work your way around the glued corner towards the “3G USB” port (no glue there)
until you reach the logo side. You should now be able to peek inside the case on the lose corner.

Next proceed along to the LED side, but beware of the fragile light conductors running straight
down beneath the clear plastic. They easily bend or break when you push-in your tool too far.
Once three sides are open, you can steadily lift the lid until the remaining side breaks lose and
neatly frees the second hinge in the process. If you work carefully and manage not to break
either one of the two hinges, the gray lid should snap neatly back into place after some manual
cleaning with a cutter knife.

Warning!
Be careful not to scratch PCB traces if you use a flat screwdriver to open the case.
Don't apply downwards pressure on the PCB itself with the tip of the screwdriver. Always
point the tip of the screwdriver upwards, practicing a pressure from bottom to top.
I just managed to practically kill an MR3020 because I scratched the ethernet port
trace!

Internal Pictures
Internal Pictures MR-3020 v3
Serial Console
Pinout

1 2 3 4

TX RX GND VCC SJ1

Pin 1 is clearly marked on the board.

To get a reliable serial connection, you might have to connect a 10k pullup resistor between TX
and VCC. This is because the TX pin is connected to a voltage divider (2×5.6k) and a capacitor is
put between the real pin and the TX connector. Some serial adaptors might work without the
pullup resistor (confirmed for one ST3232-based adaptor), but others definitely require it
(confirmed for a FTDI FT232RL-based model).

If you need a serial adaptor, you can build a serial hack adapter (http://buffalo.nas-
central.org/index.php/Use_a_Nokia_Serial_Cable_on_an_ARM9_Linkstation#Preparing_the_Cable)
(DKU-5, CA-42). Relatively cheap, off-the-shelf and known-to-work alternatives would be
SparkFun's FTDI Basic Breakout 3.3V (http://www.sparkfun.com/products/9873) and FTDI Serial
Cable 3.3V (http://www.sparkfun.com/products/9717) (the resistor is not needed with this
specific cable).

The right settings for accessing the serial console are as follows:

Bits per second: 115200

Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

If you are using a Linux or Mac system, the easiest way to connect to the serial console would be
the screen command. It comes pre-installed on OS () X, but must usually be installed on Linux
systems. When installed, just type in a terminal:

screen /dev/[device name] 115200

where [device name] is the name of your serial adaptor, usually tty.usbserial* on Mac and
ttyUSB* on Linux. To quit screen, press CTRL-a, followed by CTRL-k, followed by y.

U-Boot Bootloader Console

The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is
displaying:

[...]
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

U-Boot accepts several commands. Type help to display the list of available commands.

hornet> help
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version

Linux Console
Once the original firmware has booted up completely, you can press return to activate the Linux
login prompt.

The password to get a root Shell access is 5up:

TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none)

TL-MR3020 login: root
password: 5up

GPIOs
→ port.gpio The AR933x platform provides 30 GPIOs. Some of them are used by the router for
status LEDs, buttons and other stuff. The table below shows the results of some investigation:

Voltage level at GPIO in gpioX/value in input-

output-mode mode when GPIO is:
 Voltage level at GPIO in gpioX/value
Pulled in input-
PCB output-mode mode when
to GPIOPulled
is:
GPIO Common Name Name gpioX/value=1 gpioX/value=0 Floating GND to Vcc

Pulled
PCB to Pulled
GPIO Common Name Name gpioX/value=1 gpioX/value=0 Floating GND to Vcc

0 WLAN () LED LED4

1 unknown. pulled R2
high

6 USB Power R107

7 unused Pulled to R15

ground

8 USB power R112 2.8V

10

11 WPS button

12

13

14

15

16

17 Ethernet LED LED5

18 Sliding Sw.

19

20 Sliding Sw.

21

22

23
 Voltage level at GPIO in gpioX/value in input-
output-mode mode when GPIO is:

Pulled
PCB to Pulled
GPIO Common Name Name gpioX/value=1 gpioX/value=0 Floating GND to Vcc

24

25

26 WPS LED LED2

27 Internet LED LED3

28

29 unused Pulled to R17

ground

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it
is explained on a page of the Squidge-Project (http://squidge.sourceforge.net/gpio/). Kernel
modules occupying that resource need to be removed before (e.g. “leds-gpio” and “gpio-
buttons”). In output-mode, voltage levels of the GPIOs were measured against GND, after the
value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file
/sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND
or pulled to Vcc.

Example: Reset USB modem

#!/bin/sh
echo "Turning USB power off"
echo 0 > /sys/class/gpio/gpio6/value
echo "Wait 5 sec"
sleep 5
echo "Turning USB power on"
echo 1 > /sys/class/gpio/gpio6/value

The sliding switch has the following truth table:

Mode Switch GPIO18 GPIO20

3G 1 0

WISP 0 1

AP () 1 1

LEDs
How to configure LEDs in general, see the LED section in the led_configuration.

The TL-MR3020 has 5 LEDs:

LED name LED print Internal name Trigger

Power Power symbol N/A (fixed supply) N/A

3G Internet symbol tl-mr3020:green:3g USB:1-1

Wireless LAN () WLAN () symbol tl-mr3020:green:wlan phy0tpt

LAN () LAN () symbol tl-mr3020:green:lan netdev:eth0

WPS WPS tl-mr3020:green:wps User preference

Buttons
→ hardware.button The TP-Link TL-MR3020 has one button and one sliding switch with three
positions:

BUTTON Event

Sliding Switch BTN_0 and BTN_1

WPS Button WPS

The WPS button is located at the top (illuminated by the WPS LED) and can be easily pressed
with a finger. The sliding switch is located at the side and has three positions: 3G, WISP, AP ().

Sample scripts to read the sliding switch: on boot (https://forum.openwrt.org/viewtopic.php?

pid=172111#p172111), on switch change (https://forum.openwrt.org/viewtopic.php?
pid=172110#p172110), to change network configurations
(https://gist.github.com/jefferyto/8010733)

Bootloader Mods
Information about bootloader in general and Das U-Boot in particular.

U-Boot 1.1.4 modification for routers

Forum member pepe2k (https://forum.openwrt.org/profile.php?id=72549) made a modification
of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed,
so new devices and SoCs will be supported in the future).
This modification started from wr703n-uboot-with-web-failsafe
(http://code.google.com/p/wr703n-uboot-with-web-failsafe/) project, but supports more
devices, all modern web browsers, has a lot of improvements and other modifications (like U-
Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

Official repository on GitHub: U-Boot 1.1.4 modification for routers

(https://github.com/pepe2k/u-boot_mod)
Discussion about this project on OpenWrt forum
(https://forum.openwrt.org/viewtopic.php?id=43237)
An article (in Polish) about one of the first version of this project on www.tech-blog.pl
(http://www.tech-blog.pl/2013/03/29/zmodyfikowany-u-boot-dla-routerow-tp-link-z-
atheros-ar9331-z-trybem-aktualizacji-oprogramowania-przez-www-i-konsola-sieciowa-
netconsole/)

Version 3.0
http://stereo.hq.phicoh.net/~philip/tp-link-mr3020-v3.0.jpg
(http://stereo.hq.phicoh.net/~philip/tp-link-mr3020-v3.0.jpg)

The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX
(keyboard input).

Hardware Hacks

Simple directional antenna

Swedish FreiFunk community Pjodd (http://pjodd.se) have a tutorial for how to put MR3020 in a
small metall bowl from IKEA and weather proofing it for outdoor use in order to give the router a
directional gain of what seems to be about 5 dBi, allowing for two such installations to
communicate with each other at a distance of perhaps 1 km.

http://wiki.pjodd.se/mediawiki/index.php/Blandtenna
(http://wiki.pjodd.se/mediawiki/index.php/Blandtenna)
External Antenna Hack
If you want to add an external antenna connector or would like to know more about the MR3020
power consumption in different op-states you can find more info Apollo-NG MR3020 External
Antenna Hack (https://apollo.open-resource.org/lab:argus#modifications)

External antenna output power

TL;DR (): The signal dBm and signal distortion level sweetspot is somewhere between txpower
1000 and 1200.

Using region SE iw reg set SE , a 20MHz wide signal on channel 9, I measured the following
output power from one of my TL-MR3020 with external antenna:

Signal dBm Noise dB txpower

 -6 >41 100

-2 >41 500

0 >41 800

0.5 >41 900

2 1000

3 1200

6 35 1500

7 1800

7.5 28 2700

Where txpower was set using iw phy0 set txpower fixed n and noise is the leaking
distortion outside of the 20MHz signal bandwidth.

As a control I made a few measurements on a second TL-MR3020 with external antenna and got
the following results:

Signal dBm Noise dB txpower

-2 >41 800

2 40 1200

4 36 1500

6 32 2600

The difference is rather small and probably due to soldering and possibly quality of analogue
components on the PCB. Noise level is rather constant between the two tests though.

At the time of these tests the RP-SMA connectors was soldered on rather quick and dirty, and
plenty of room was left between the connector and the PCB.
Image of not so well soldered connector

I've now cut the top side connector pins shorter and soldered the connector very close to the
PCB instead, plus scratched up a bit more ground on the back side of the PCB, which I also
soldered the back side connector ground pins to. Both for a better signal and to make it more
sturdy. With some luck this can have increased the signal strength by 1dBm and lowered the
signal distortion. Didn't measure again though, just seen that it works better with less noise and
greater connection speed.

Image of RP-SMA connector with cut pins

Image of RP-SMA with cut pins soldered close to PCB

Image of backside of PCB scratch to get more ground. Notice that I've only scratched for one pin
on this image. In the end I scratched for both legs and soldered them on there, visible in the next
image.

Image of RP-SMA soldered also to ground of backside of PCB

Signal distortion
Is is very evident that the greater txpower, the greater amount of noise and distortion in the
signal. The signal is very clear around txpower 800, while rather terrible when set to 1800 and
more.
 Image of analysis of the 20MHz signal at txpower 800

Image of analysis of the 20MHz signal at txpower 900

Image of analysis of the 20MHz signal at txpower 1200

Image of analysis of the 20MHz signal at txpower 1800

Image of analysis of the 20MHz signal at txpower 2700

Image of txpower 2700 is analyzed on a different rounter than the previous lower txpower
images, mainly visible on the dBm and not the distortion.
Notice the amount of distortion outside of the 20MHz signal at 1800 compared to 1200 or 900. It
is hard to say how much of this distortion is also available in the 20MHz signal, my guess is at
least as much. This cripples the signal, making a greater txpower probably a worse signal with
less speed than one without the distortion.

The txpower sweetspot is therefor estimated to be 1000-1200. This would equal a signal
strength of 2-4dBm (1.5-2.5mW). To max that up to the common legal maximum of 100mW ERP
you'll need an 18-21dBi antenna. You'll be much better of with a clean signal and a high gain
antenna than attempting to crank up the signal strength to a level where it only cripple the signal
with distortion.

Adding I2C Bus

If you want to add I2C bus to your MR3020, you can use GPIO 7 and 29. Remove R15 and R17,
then add pullup between 3.3v and gpio pin.
Next step, add this line

i2c-gpio-custom bus0=0,7,29

to /etc/modules.d/99-i2c

and load i2c-gpio-custom

You can find more info in french here http://www.equinoxefr.org/post/2012/11/12/mr3020-et-

i2c-avec-les-gpio/ (http://www.equinoxefr.org/post/2012/11/12/mr3020-et-i2c-avec-les-gpio/)

Adding I2C Bus for v3

Use GPIO 37 and 43. Remove Power and 3G LEDs.
Next add this to startup:

rmmod leds-gpio
insmod i2c-gpio-custom bus0=0,37,43

USB Hub Hack

You can embedded usb hub to add more peripheral to your best router.

I hack a 3$ STOREX usb hub, a 2$ µSD card reader and a 10$ webcam to build a robot with my
MR3020.
More info in french on http://www.equinoxefr.org/post/2012/11/05/projet-de-robot-wifi-torture-
dun-routeur-tplink-mr3020/ (http://www.equinoxefr.org/post/2012/11/05/projet-de-robot-wifi-
torture-dun-routeur-tplink-mr3020/)

GPIO Pinout
V3 Leds GPIO Pinout

USB port and monitoring Serial Console via

USB-Serial
The USB port on the TL-MR3020 is not compatible with USB devices that use low-speed
(1.5Mbps) and only works properly with USB devices that use fast-speed (12Mbps) or high-
speed (480Mbps). You can however plug a USB-Serial adapter as long as you plug that through a
<$10 USB 2.0 hub that reports itself in dmesg as using high-speed (480Mbps); USB hubs that
use fast-speed (even if they are marketed as USB 2.0) do not work in the TL-MR3020 when a low-
speed device is connected in one of its ports. While you're at it, use another port of the USB hub
to plug in a USB thumb drive and write data there (like serial console logs) so as not to wear out
the built-in flash.

You can check if your device is using low, fast or high speed with dmesg command.

See this page for more tips and how to create a serial console server out of your TL-MR3020:
http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html
(http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html)

See this forum thread for more info about why the USB port does not work with low speed
devices: https://forum.openwrt.org/viewtopic.php?id=39956
(https://forum.openwrt.org/viewtopic.php?id=39956)

Boot log

OEM Bootlog
U-Boot 1.1.4 (Aug 17 2011 - 09:25:09) AP121-2MB (ar9330) U-boot DRAM: 32 MB led turning on
for 1s... id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default
environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in
Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad ag7240_phy_setup eth0 up : cfg1 0xf cfg2 0x7214 eth1:
00:03:7f:09:0b:ad athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done
ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000
... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR9330(Hornet)... Linux version
2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #185 Fri Oct 21 16:26:50 CST
2011 flash_size passed from bootloader = 4 CPU revision is: 00019374 (MIPS 24Kc) Determined
physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 ->
0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel
command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init
mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2,
16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction
cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases,
linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory:
29864k/32768k available (1889k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem)
Hierarchical RCU implementation. NR_IRQS:128 plat_time_init: plat time init done Calibrating
delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET:
Registered protocol family 16 ===== ar7240_platform_init: 0 Whoops! This kernel is for product
mr3020 v1.0! bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new
interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new
device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024
(order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind
hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024
bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [F lags: R/O]. msgmni has
been set to 58 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler
noop registered io scheduler anticipatory registered io scheduler deadline registered io
scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0:
detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq =
19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered
protocol family 24 cmdlinepart partition parsing not available set partition boot set partition
kernel set partition rootfs set partition config set partition art set partition ÿ Searching for
RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD
partitions on "ar7240-nor0": 0x000000000000-0x000000020000 : "boot" 0x000000020000-
0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs" 0x0000003e0000-
0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0x10215 .
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci
ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus
number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status
1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB
CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB
2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub
found hub 1-0:1.0: 1 port detected TCP cubic registered NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <[email protected]> All bugs added by David S.
Miller <[email protected]> ar7240wdt_init: Registering WDT success VFS: Mounted root
(squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 116k freed init
started: BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary This Board use 2.6.31 xt_time:
kernel timezone is -0000 nf_conntrack version 0.5.0 (512 buckets, 5120 max) ip_tables: (C) 2000-
2006 Netfilter Core Team insmod: cannot open module
`/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open
module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver,
V1.0 PPTP driver version 0.8.3 insmod: cannot open module
`/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory (none) mips #185 Now flash
open! Fri Oct 21 16:26:50 CST 2011 (none) (none) login: Now flash open! ATHR_GMAC: Length
per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit
1:bf1f0006 ATHR_GMAC: 6e:09:80:e4:67:1b ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96
ATHR_GMAC: Mac capability flags : 4D83 ATHR_GMAC: Mac address for unit 0:bf1f0000
ATHR_GMAC: 12:03:cb:60:38:f7 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max
tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability
flags : 4403 athr_gmac_ring_alloc Allocated 640 at 0x81e79800 athr_gmac_ring_alloc Allocated
4032 at 0x81d63000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting
PHY...mac 0 athr_gmac_ring_alloc Allocated 640 at 0x81e79400 athr_gmac_ring_alloc Allocated
1536 at 0x81f22000 athr_gmac_mii_setup: MDC check failed Setting Drop CRC Errors, Pause
Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting
PHY...mac 1 device eth0 entered promiscuous mode Now flash open! nf_conntrack_rtsp v0.6.21
loading nf_nat_rtsp v0.6.21 loading asf: module license 'Proprietary' taints kernel. Disabling lock
debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC,
WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc,
All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights
Reserved ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss) Boostrap clock 25MHz ar9300RadioAttach:
Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[4735] rx chainmask
mismatch actual 1 sc_chainmak 0 ath_get_caps[4710] tx chainmask mismatch actual 1
sc_chainmak 0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter.
devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit.
devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created
DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_scan_unregister_event_handler:
Failed to unregister evhandler=c0a048a0 arg=81e9e2c0 wlan_vap_delete : enter.
vaphandle=0x81e9c000 wlan_vap_delete : exit. vaphandle=0x81e9c000 wlan_vap_create : enter.
devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit.
devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created
DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_ioctl_siwmode:
imr.ifm_active=393856, new mode=3, valid=1 WARNING: Fragmentation with HT mode NOT
ALLOWED!! device ath0 entered promiscuous mode br0: port 2(ath0) entering forwarding state
ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1 br0: port 2(ath0)
entering disabled state DES SSID SET=TP-LINK_POCKET_3020_3ABB7A br0: port 2(ath0)
entering forwarding state gpio_tricolor_led_write 699 green_led_onoff = 1 TL-MR3020 mips #185
Fri Oct 21 16:26:50 CST 2011 (none) TL-MR3020 login:

OpenWrt Boot Log and Info

dmesg TP-Link TL-MR3020 (https://gist.github.com/2059480#file_dmesg)

Link Dump
Product web-page : TL-MR3020 (http://www.tp-link.com/en/products/details/?model=TL-
MR3020#fea)
The latest official firmware is available here (http://www.tp-
link.com/en/support/download/?model=TL-MR3020)
The official GPL () code is available here (http://www.tp-
link.com/resources/gpl/150Router.tar).
A backup of the whole original SPI flash content is available from here(DEAD LINK).
Taschenrouter als IPv6-Verteiler (auf Deutsch)
(http://www.heise.de/netze/artikel/Taschenrouter-als-IPv6-Verteiler-1440851.html)
Interesting webpage with more data about power consumption and so on
(https://apollo.open-resource.org/lab:argus)

Relevant Forum Links

TP-Link TL-MR3020 Support (https://forum.openwrt.org/viewtopic.php?id=33429)

Additional Photos
 Tags
fastethernet 1nic 1wnic no switch 1ant usb2.0 1usb serial integrated
802.11bgn ar9331 ath9k 32RAM 4Flash mips mips32 24kc ap121
portable router usb powered

Last modified: 2021/04/28 15:23 by sumpfralle

Self-registration in the wiki has been disabled.

If you want to contribute to the OpenWrt wiki, please post HERE (https://forum.openwrt.org/t/applying-for-openwrt-
wiki-account/101671) in the forum or ask on IRC () for access.
Except where otherwise noted, content on this wiki is licensed under the following license:
CC Attribution-Share Alike 4.0 International