TP-Link TL-MR3020
See also TL-MR3040 and TL-WR703N or TP-Link TL-MR10U, TP-Link TL-MR11U, TP-Link TL-MR12U and TP-Link TL-MR13U.
Note:
Many of these routers are marketed as a “3G travel router” but none actually include a 3G modem - the marketing term rather means that the OEM firmware supports a certain range of 3G/4G modems to be externally connected to USB because it contains drivers for those USB modems! Ignore that, because with OpenWrt ANY router with USB supports 3G/4G hardware ...
The router is powered through a mini-USB socket stub (5V) and comes with a USB power adapter. hardware revision 3.20 is powered through micro-USB socket.
Supported Hardware Versions
Model Version | Launch Date | Supported since | Model Specific Notes |
---|---|---|---|
v1.0 | 2011-12 | r29651 | AR9331 chipset |
v1.4 | 2012-01 | r29763, probably earlier | AR9331 chipset |
v1.6 | 2012-03 | r30753, probably earlier | AR9331 chipset |
v1.7 | 2012-05 | 12.09-RC1, r32786 | AR9331 chipset |
v1.8 | ?? | 12.09-RC1 | AR9331-AL1A; internal serial port has no pins, only solder-pads (P1 clearly visible) |
v1.9 | ?? | 14.07 | AR9331-AL3A OpenWrt 12.09 do not work at this Version ! |
v3.0 | ?? | 18.06.1 snapshots, commit 6bbb2202551be394fead2efd99eb946f846fc63d | MT7628NN chipset,The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX (keyboard input). |
The current release OEM source code available at: http://www.tp-link.com/resources/gpl/150Router.rar
Hardware Highlights
- Tiny form factor
- 5.7 cm x 5.7 cm PCB
- 6.7 cm x 7.4 cm x 2.2 cm case
Power consumption
Input voltage: The router will function correctly when powered with voltages as low as 3.3 Volts (determined experimentally) instead of 5V USB-Power. Thus, it can be powered directly from one single Li-Ion battery (which usually starts fully charged at 4.2V and has a nominal voltage of 3.7) without the need for an external 5V adapter.
This router is standardly powered via USB at 5V. The voltage regulators' input voltage should be at least between 3.7V - 5.5V, but not over 5.5V. The device will get damaged at too high voltages*. Maximum current draw at 5V is 255mA (Active Download + LAN + WLAN + USBboot), average current draw with WiFi is 125mA, idle is 68mA. Hence the average router power consumption is 0.6W, which is incredibly low.
Power consumption will be higher if a USB device is attached to its USB port! More information and a rough diagram here Interesting webpage with more data about power consumption and so on
Installation
Method Using Web GUI (Recommended)
Web GUI upload has been confirmed to work with v1.0, v1.4, v1.6, v1.7, v1.8 and 1.9 hardware revisions and requires no serial or TFTP access unless something goes wrong.
Log in to the router's web GUI (default login/password: admin / admin) and flash with openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware image like a regular firmware update.
Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed with proceed with basic configuration as with any fresh OpenWrt install.
See forum if you encounter problems.
Method using TFTP (Experts)
At least for model v3 it is possible to upload the OpenWrt image via TFTP without using the serial console. See the Bootloader Recovery for details.
For older models it may be necessary to use the manual TFTP upload method, which requires a serial console connection (see below).
Manual Method Using Serial Console and TFTP (Experts)
To install OpenWrt from the U-Boot console, you need to install a TFTP server on your computer (tftp-hpa is recommended).
Then download OpenWrt factory image to /srv/tftp (for example), and execute the TFTP server by typing tftpd -l -s /srv/tftp.
Connect the TL-MR3020 using a serial console and power up the TL-MR3020.
After a 1-2 seconds it shows Autobooting in 1 seconds, when displaying this enter tpl immediately.
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]
You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands:
hornet> setenv ipaddr <device-ip, eg. 192.168.1.111> hornet> setenv serverip <server-ip, eg. 192.168.1.100> hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin eth1 link down dup 1 speed 100 Using eth0 device TFTP from server 192.168.1.100; our IP address is 192.168.1.111 Filename 'openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'. Load address: 0x80000000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ###################################################### done Bytes transferred = 3932160 (3c0000 hex) hornet> erase 0x9f020000 +0x3c0000 First 0x2 last 0x3d sector size 0x10000 61 Erased 60 sectors hornet> cp.b 0x80000000 0x9f020000 0x3c0000 Copy to Flash... write addr: 9f020000 done hornet> bootm 9f020000
OEM Mass Flashing
Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:
#!/bin/bash # Pass the firmware file to be flashed as the first parameter. # # The second curl call will time out, but it's expected. Once the # script exits you can unplug the ethernet cable and proceed to the # next router, but KEEP each router ON POWER until the new image is # fully written! When flashing is done the router automatically # reboots (as shown by all the leds flashing once). curl \ --user admin:admin \ --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \ --referer 'http://192.168.0.254/userRpm/SoftwareUpgradeRpm.htm' \ --form "Filename=@$1" -F 'Upgrade=Upgrade' \ http://192.168.0.254/incoming/Firmware.htm > ans.html # > /dev/null sleep 1 session_id=$(sed -n 's/var session_id = \"\(.*\)\".*/\1/p' ans.html) curl \ --max-time 2 \ --user admin:admin \ --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \ --referer 'http://192.168.0.254/incoming/Firmware.htm' \ http://192.168.0.254/userRpm/FirmwareUpdateTemp.htm?session_id=$session_id > /dev/null
Install Snapshot Image
If you install openwrt from trunk, the firmware image doesn't include LuCi. You need configure wireless network from telnet to install Luci. You will need already working internet access.
For this example:
Main router:
Ip: '192.168.2.1' Ssid: 'Example-network' Bssid: '11:11:11:11:11:11' Encryption: 'WPA2 - PSK' Key: 'PaSSworD' Channel: '9'
( You need fill these by your network properities )
Terminal program:
Putty
After install trunk image wait few minutes then recycle power router and set your computer ip address to:
ip: 192.168.1.2 subnet: 255.255.255.0 gateway: 192.168.1.1
Start your terminal and connect 192.168.1.1 via telnet ( port 23 ). Right now LAN INTERFACE include wireless too. We need to set wireless to WAN interface. Change wireless configuration below example.
vi /etc/config/wireless config wifi-device radio0 option type mac80211 option channel 9 option hwmode 11ng option path 'platform/ar933x_wmac' option htmode HT20 list ht_capab SHORT-GI-20 list ht_capab SHORT-GI-40 list ht_capab RX-STBC1 list ht_capab DSSS_CCK-40 option disabled 0 option txpower 27 config wifi-iface option device radio0 option network wan option mode sta option ssid Example-network option encryption psk2 option bssid 11:11:11:11:11:11 option key PaSSworD
Wireless setup completed now we need to get ip WAN interface via main router dhcp server. Set your network config like below example.
vi /etc/config/network config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config globals 'globals' option ula_prefix 'fd48:931d:0f42::/48' config interface 'lan' option ifname 'eth0' option type 'bridge' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' option ip6assign '60' config interface 'wan' option proto 'dhcp' option _orig_ifname radio0 option _orig_bridge false
Reboot your router
reboot
Your terminal session will be closed. You need reconnect to router.
Test your router: If your router is properly connected to the internet you should get something like the below lines:
ping -c3 www.google.com PING www.google.com (xxx.xxx.xxx.xxx): 56 data bytes 64 bytes from xxx.xxx.xxx.xxx: seq=0 ttl=52 time=88.295 ms 64 bytes from xxx.xxx.xxx.xxx: seq=1 ttl=52 time=87.783 ms 64 bytes from xxx.xxx.xxx.xxx: seq=2 ttl=52 time=87.503 ms --- www.google.com ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 87.503/87.860/88.295 ms
Now you can install Luci and enable it by below commands:
opkg update opkg install luci /etc/init.d/uhttpd enable /etc/init.d/uhttpd start
Now you can access LuCi interface by 192.168.1.1 with your browser.
How To Enable Reset Functionality
By default reset button won't work , as it is only assigned for WPS(in present source code Chaos Calmer 15.0)
*method 1 :
You can enable that functionality , by manually write script in /etc/hotplog.d/button/buttons file, where you can check the $BUTTON type and according to that write action for reset.
*method 2 :
change in file 1 : openwrt/build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/arch/mips/ath79/mach-tl-mr3020.c OR file 2 : openwrt/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-mr3020.c change wps to reset #define TL_MR3020_GPIO_BTN_RESET 11 static struct gpio_keys_button tl_mr3020_gpio_keys[] __initdata = { { .desc = "Reset button", .type = EV_KEY, .code = KEY_RESTART, .debounce_interval = TL_MR3020_KEYS_DEBOUNCE_INTERVAL, .gpio = TL_MR3020_GPIO_BTN_RESET, .active_low = 0, },
TRAC ticket has been raised at https://dev.openwrt.org/ticket/22951 (will delete this line after changes are made in source code)
Failsafe Mode
- Power on the TL-MR3020
- When the WPS button starts to blink:
- on AA (Attitude Adjustment / 12.09) push the WPS button;
- on BB (Breaking Barrier / trunk) move the sliding switch quickly from one side to the other.
- on CC (Chaos Calmer) ??? not sure try any switches or buttons ??? repeatedly is fine. 12/11/2015: repeatdly pushing the WPS worked.
- Do this until the WPS button starts blinking faster.
- The device is now in Failsafe-Mode
- Connect the TL-MR3020 to your computer via ethernet
Follow further instructions at: failsafe
Downgrade Attitute Adjustment from Trunk
Downgraded wrong image ( jff2 instead of squashfs ) cause cant get ip or connect to luci. Failsafe mode still working but firstboot command wont work because it is already on working. You can upload correct firmware and write it with mtd command but failsafe mode can't connect internet. You need to local tftp server to get firmware.
Set your pc ip 192.168.1.10/24 and gateway 192.168.1.1. Download mongoose http server and correct firmware same folder and start mongoose. It will host all files in his path ( if you start it from downloads folder it will host all files in downloads folder )
now we can get firmware via failsafe telnet:
wget http://192.168.1.10:8080/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin mtd -r write /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware Writing from /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin to firmware ... Rebooting ... /bin/sh: /sbin/reboot: Input/output error
DONT DO ANYTHING. Just wait and router reboot itself. wait few minutes and you will able to reach Luci via 192.168.1.1.
Restoring Original Firmware
With the TL-MR3020 router, there is a catch: the stock firmware is obtained from the OEM: http://www.tplink.com/en/support/download/?model=TL-MR3020
- in case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware
- in case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it:
An example of an image file with the word “boot” in it is mr3020nv1_en_3_17_2_up_boot(140408).bin
.
Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:
dd if=orig.bin of=tplink.bin skip=257 bs=512
You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):
Via the safer method using sysupgrade:
sysupgrade /tmp/tplink.bin
Or you use the mtd method:
mtd -r write /tmp/tplink.bin firmware
It is also possible to revert to the stock firmware using the method with tftp described in “Manual Method Using Serial Console and TFTP (Experts)”. (you still need the firmware images without the boot part).
OEM TP-Link firmware for the TL-MR3020 with the boot part removed to revert to the original OEM firmware:
- TL-MR3020 V1 http://www.friedzombie.com/tplink-stripped-firmware search for TL-MR3020-V1
Bootloader Recovery
This is confirmed working on a MR3020 v3. You can grab a stock TP-Link that's been snipped of its header, or grab an OpenWRT image with recovery in its name such as “openwrt-ramips-mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recovery.bin”
- Grab Tftpd64 https://archive.codeplex.com/?p=tftpd64 or any other TFTP server of your choice.
- Set your ethernet IP to 192.168.0.225/24 , the MR3020 will show up at 192.168.0.2
- Rename your recovery bin to tp_recovery.bin and point Tftpd64 to the directory your leaving the file in.
- Plug in your ethernet cable.
- Hold down the WPS button and power the device on, the 2nd LED will fast trigger after a moment, release button, the TFTP server should report a file being downloaded.
- Wait until it starts slow flashing and then reboots.
You're back to stock !
Basic Configuration
Since this part is identical to the one recommended for generic devices, see Basic configuration.
Original Flash Layout
Please read the article flash.layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:
TP-Link MR3020 Flash Layout stock firmware | |||||
---|---|---|---|---|---|
Layer0 | spi0.0: 4096KiB | ||||
Layer1 | mtd0 | mtd1 | mtd2 | mtd3 | mtd4 |
Size in KiB | 128KiB | 1024KiB | 2816 KiB | 64KiB | 64KiB |
Name | u-boot | kernel | rootfs | config | art |
mountpoint | none | none | / | none | none |
filesystem | none | none | SquashFS | none | none |
ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.
Hardware
Hardware summary
IC | Info / Datasheet | |
---|---|---|
Chipset (WiSoC) | AR9331 | https://wikidevi.com/wiki/Atheros_AR9331 |
Flash ROM | Spansion S25FL032P | http://www.spansion.com/Support/Datasheets/S25FL032P_00.pdf |
SDRAM | Windbond W9425G6JH | http://www.winbond.com/NR/rdonlyres/11505884-F632-41F9-9438-A3EC025FEAED/0/W9425G6JH.pdf |
Zentel A3S56D40FTP-G5 |
Opening the Case
The case consists of two parts: a white base and a gray lid. The lid has two snap hinges, one right above the mini USB connector and one on the opposite side about 10 mm left of the “TP-LINK” logo. The lid is additionally glued in place on the underside on all four sides. You can try to pry it open with a thin but very stable blade tool. Start above the ethernet port where the case is not glued, and work your way around the glued corner towards the “3G USB” port (no glue there) until you reach the logo side. You should now be able to peek inside the case on the lose corner.
Next proceed along to the LED side, but beware of the fragile light conductors running straight down beneath the clear plastic. They easily bend or break when you push-in your tool too far. Once three sides are open, you can steadily lift the lid until the remaining side breaks lose and neatly frees the second hinge in the process. If you work carefully and manage not to break either one of the two hinges, the gray lid should snap neatly back into place after some manual cleaning with a cutter knife.
Internal Pictures
Internal Pictures MR-3020 v3
Serial Console
Pinout
1 | 2 | 3 | 4 | ||
---|---|---|---|---|---|
TX | RX | GND | VCC | SJ1 |
Pin 1 is clearly marked on the board.
To get a reliable serial connection, you might have to connect a 10k pullup resistor between TX and VCC. This is because the TX pin is connected to a voltage divider (2×5.6k) and a capacitor is put between the real pin and the TX connector. Some serial adaptors might work without the pullup resistor (confirmed for one ST3232-based adaptor), but others definitely require it (confirmed for a FTDI FT232RL-based model).
If you need a serial adaptor, you can build a serial hack adapter (DKU-5, CA-42). Relatively cheap, off-the-shelf and known-to-work alternatives would be SparkFun's FTDI Basic Breakout 3.3V and FTDI Serial Cable 3.3V (the resistor is not needed with this specific cable).
The right settings for accessing the serial console are as follows:
Bits per second: 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None
If you are using a Linux or Mac system, the easiest way to connect to the serial console would be the screen command. It comes pre-installed on OS X, but must usually be installed on Linux systems. When installed, just type in a terminal:
screen /dev/[device name] 115200
where [device name] is the name of your serial adaptor, usually tty.usbserial* on Mac and ttyUSB* on Linux. To quit screen, press CTRL-a, followed by CTRL-k, followed by y.
U-Boot Bootloader Console
The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying:
[...]
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]
U-Boot accepts several commands. Type help to display the list of available commands.
hornet> help ? - alias for 'help' bootm - boot application image from memory cp - memory copy erase - erase FLASH memory help - print online help md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) printenv- print environment variables progmac - Set ethernet MAC addresses reset - Perform RESET of the CPU setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version
Linux Console
Once the original firmware has booted up completely, you can press return to activate the Linux login prompt.
The password to get a root Shell access is 5up:
TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none) TL-MR3020 login: root password: 5up
GPIOs
→ port.gpio The AR933x platform provides 30 GPIOs. Some of them are used by the router for status LEDs, buttons and other stuff. The table below shows the results of some investigation:
Voltage level at GPIO in output-mode | gpioX/value in input-mode when GPIO is: | ||||||
---|---|---|---|---|---|---|---|
GPIO | Common Name | PCB Name | gpioX/value=1 | gpioX/value=0 | Floating | Pulled to GND | Pulled to Vcc |
0 | WLAN LED | LED4 | |||||
1 | unknown. pulled high | R2 | |||||
2 | |||||||
3 | |||||||
4 | |||||||
5 | |||||||
6 | USB Power | R107 | |||||
7 | unused Pulled to ground | R15 | |||||
8 | USB power | R112 | 2.8V | ||||
9 | |||||||
10 | |||||||
11 | WPS button | ||||||
12 | |||||||
13 | |||||||
14 | |||||||
15 | |||||||
16 | |||||||
17 | Ethernet LED | LED5 | |||||
18 | Sliding Sw. | ||||||
19 | |||||||
20 | Sliding Sw. | ||||||
21 | |||||||
22 | |||||||
23 | |||||||
24 | |||||||
25 | |||||||
26 | WPS LED | LED2 | |||||
27 | Internet LED | LED3 | |||||
28 | |||||||
29 | unused Pulled to ground | R17 |
To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. “leds-gpio” and “gpio-buttons”). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.
Example: Reset USB modem
#!/bin/sh echo "Turning USB power off" echo 0 > /sys/class/gpio/gpio6/value echo "Wait 5 sec" sleep 5 echo "Turning USB power on" echo 1 > /sys/class/gpio/gpio6/value
The sliding switch has the following truth table:
Mode Switch | GPIO18 | GPIO20 |
---|---|---|
3G | 1 | 0 |
WISP | 0 | 1 |
AP | 1 | 1 |
LEDs
How to configure LEDs in general, see the LED section in the led_configuration.
The TL-MR3020 has 5 LEDs:
LED name | LED print | Internal name | Trigger |
---|---|---|---|
Power | Power symbol | N/A (fixed supply) | N/A |
3G | Internet symbol | tl-mr3020:green:3g | USB:1-1 |
Wireless LAN | WLAN symbol | tl-mr3020:green:wlan | phy0tpt |
LAN | LAN symbol | tl-mr3020:green:lan | netdev:eth0 |
WPS | WPS | tl-mr3020:green:wps | User preference |
Buttons
→ hardware.button The TP-Link TL-MR3020 has one button and one sliding switch with three positions:
BUTTON | Event |
---|---|
Sliding Switch | BTN_0 and BTN_1 |
WPS Button | WPS |
The WPS button is located at the top (illuminated by the WPS LED) and can be easily pressed with a finger. The sliding switch is located at the side and has three positions: 3G, WISP, AP.
Sample scripts to read the sliding switch: on boot, on switch change, to change network configurations
Bootloader Mods
Information about bootloader in general and Das U-Boot in particular.
U-Boot 1.1.4 modification for routers
Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future).
This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).
More information:
- Official repository on GitHub: U-Boot 1.1.4 modification for routers
- Discussion about this project on OpenWrt forum
- An article (in Polish) about one of the first version of this project on www.tech-blog.pl
Version 3.0
http://stereo.hq.phicoh.net/~philip/tp-link-mr3020-v3.0.jpg
The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX (keyboard input).
Hardware Hacks
Simple directional antenna
Swedish FreiFunk community Pjodd have a tutorial for how to put MR3020 in a small metall bowl from IKEA and weather proofing it for outdoor use in order to give the router a directional gain of what seems to be about 5 dBi, allowing for two such installations to communicate with each other at a distance of perhaps 1 km.
External Antenna Hack
If you want to add an external antenna connector or would like to know more about the MR3020 power consumption in different op-states you can find more info Apollo-NG MR3020 External Antenna Hack
External antenna output power
TL;DR: The signal dBm and signal distortion level sweetspot is somewhere between txpower 1000 and 1200.
Using region SE iw reg set SE
, a 20MHz wide signal on channel 9, I measured the following output power from one of my TL-MR3020 with external antenna:
Signal dBm | Noise dB | txpower | |||
-6 | >41 | 100 | |||
-2 | >41 | 500 | |||
0 | >41 | 800 | |||
0.5 | >41 | 900 | |||
2 | 1000 | ||||
3 | 1200 | ||||
6 | 35 | 1500 | |||
7 | 1800 | ||||
7.5 | 28 | 2700 |
Where txpower was set using iw phy0 set txpower fixed n
and noise is the leaking distortion outside of the 20MHz signal bandwidth.
As a control I made a few measurements on a second TL-MR3020 with external antenna and got the following results:
Signal dBm | Noise dB | txpower | |||
-2 | >41 | 800 | |||
2 | 40 | 1200 | |||
4 | 36 | 1500 | |||
6 | 32 | 2600 |
The difference is rather small and probably due to soldering and possibly quality of analogue components on the PCB. Noise level is rather constant between the two tests though.
At the time of these tests the RP-SMA connectors was soldered on rather quick and dirty, and plenty of room was left between the connector and the PCB.
Image of not so well soldered connector
I've now cut the top side connector pins shorter and soldered the connector very close to the PCB instead, plus scratched up a bit more ground on the back side of the PCB, which I also soldered the back side connector ground pins to. Both for a better signal and to make it more sturdy. With some luck this can have increased the signal strength by 1dBm and lowered the signal distortion. Didn't measure again though, just seen that it works better with less noise and greater connection speed.
Image of RP-SMA connector with cut pins
Image of RP-SMA with cut pins soldered close to PCB
Image of backside of PCB scratch to get more ground. Notice that I've only scratched for one pin on this image. In the end I scratched for both legs and soldered them on there, visible in the next image.
Image of RP-SMA soldered also to ground of backside of PCB
Signal distortion
Is is very evident that the greater txpower, the greater amount of noise and distortion in the signal. The signal is very clear around txpower 800, while rather terrible when set to 1800 and more.
Image of analysis of the 20MHz signal at txpower 800
Image of analysis of the 20MHz signal at txpower 900
Image of analysis of the 20MHz signal at txpower 1200
Image of analysis of the 20MHz signal at txpower 1800
Image of analysis of the 20MHz signal at txpower 2700
Image of txpower 2700 is analyzed on a different rounter than the previous lower txpower images, mainly visible on the dBm and not the distortion.
Notice the amount of distortion outside of the 20MHz signal at 1800 compared to 1200 or 900. It is hard to say how much of this distortion is also available in the 20MHz signal, my guess is at least as much. This cripples the signal, making a greater txpower probably a worse signal with less speed than one without the distortion.
The txpower sweetspot is therefor estimated to be 1000-1200. This would equal a signal strength of 2-4dBm (1.5-2.5mW). To max that up to the common legal maximum of 100mW ERP you'll need an 18-21dBi antenna. You'll be much better of with a clean signal and a high gain antenna than attempting to crank up the signal strength to a level where it only cripple the signal with distortion.
Adding I2C Bus
If you want to add I2C bus to your MR3020, you can use GPIO 7 and 29. Remove R15 and R17, then add pullup between 3.3v and gpio pin.
Next step, add this line
i2c-gpio-custom bus0=0,7,29
to /etc/modules.d/99-i2c
and load i2c-gpio-custom
You can find more info in french here http://www.equinoxefr.org/post/2012/11/12/mr3020-et-i2c-avec-les-gpio/
Adding I2C Bus for v3
Use GPIO 37 and 43. Remove Power and 3G LEDs.
Next add this to startup:
rmmod leds-gpio insmod i2c-gpio-custom bus0=0,37,43
USB Hub Hack
You can embedded usb hub to add more peripheral to your best router.
I hack a 3$ STOREX usb hub, a 2$ µSD card reader and a 10$ webcam to build a robot with my MR3020.
More info in french on http://www.equinoxefr.org/post/2012/11/05/projet-de-robot-wifi-torture-dun-routeur-tplink-mr3020/
GPIO Pinout
V3 Leds GPIO Pinout
USB port and monitoring Serial Console via USB-Serial
The USB port on the TL-MR3020 is not compatible with USB devices that use low-speed (1.5Mbps) and only works properly with USB devices that use fast-speed (12Mbps) or high-speed (480Mbps). You can however plug a USB-Serial adapter as long as you plug that through a <$10 USB 2.0 hub that reports itself in dmesg as using high-speed (480Mbps); USB hubs that use fast-speed (even if they are marketed as USB 2.0) do not work in the TL-MR3020 when a low-speed device is connected in one of its ports. While you're at it, use another port of the USB hub to plug in a USB thumb drive and write data there (like serial console logs) so as not to wear out the built-in flash.
You can check if your device is using low, fast or high speed with dmesg command.
See this page for more tips and how to create a serial console server out of your TL-MR3020: http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html
See this forum thread for more info about why the USB port does not work with low speed devices: https://forum.openwrt.org/viewtopic.php?id=39956
Boot log
OEM Bootlog
U-Boot 1.1.4 (Aug 17 2011 - 09:25:09) AP121-2MB (ar9330) U-boot DRAM: 32 MB led turning on for 1s... id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad ag7240_phy_setup eth0 up : cfg1 0xf cfg2 0x7214 eth1: 00:03:7f:09:0b:ad athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #185 Fri Oct 21 16:26:50 CST 2011 flash_size passed from bootloader = 4 CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29864k/32768k available (1889k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 Whoops! This kernel is for product mr3020 v1.0! bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [F lags: R/O]. msgmni has been set to 58 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered protocol family 24 cmdlinepart partition parsing not available set partition boot set partition kernel set partition rootfs set partition config set partition art set partition ÿ Searching for RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs" 0x0000003e0000-0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0x10215 . ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 116k freed init started: BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary This Board use 2.6.31 xt_time: kernel timezone is -0000 nf_conntrack version 0.5.0 (512 buckets, 5120 max) ip_tables: (C) 2000-2006 Netfilter Core Team insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver, V1.0 PPTP driver version 0.8.3 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory (none) mips #185 Now flash open! Fri Oct 21 16:26:50 CST 2011 (none) (none) login: Now flash open! ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 1:bf1f0006 ATHR_GMAC: 6e:09:80:e4:67:1b ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 ATHR_GMAC: Mac address for unit 0:bf1f0000 ATHR_GMAC: 12:03:cb:60:38:f7 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 athr_gmac_ring_alloc Allocated 640 at 0x81e79800 athr_gmac_ring_alloc Allocated 4032 at 0x81d63000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY...mac 0 athr_gmac_ring_alloc Allocated 640 at 0x81e79400 athr_gmac_ring_alloc Allocated 1536 at 0x81f22000 athr_gmac_mii_setup: MDC check failed Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY...mac 1 device eth0 entered promiscuous mode Now flash open! nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss) Boostrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c0a048a0 arg=81e9e2c0 wlan_vap_delete : enter. vaphandle=0x81e9c000 wlan_vap_delete : exit. vaphandle=0x81e9c000 wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 WARNING: Fragmentation with HT mode NOT ALLOWED!! device ath0 entered promiscuous mode br0: port 2(ath0) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1 br0: port 2(ath0) entering disabled state DES SSID SET=TP-LINK_POCKET_3020_3ABB7A br0: port 2(ath0) entering forwarding state gpio_tricolor_led_write 699 green_led_onoff = 1 TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none) TL-MR3020 login:
OpenWrt Boot Log and Info
Link Dump
- Product web-page : TL-MR3020
- The latest official firmware is available here
- The official GPL code is available here.
A backup of the whole original SPI flash content is available from here(DEAD LINK).