TP-Link TL-MR3020

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

See also TL-MR3040 and TL-WR703N or TP-Link TL-MR10U, TP-Link TL-MR11U, TP-Link TL-MR12U and TP-Link TL-MR13U.

Note: Many of these routers are marketed as a “3G travel router” but none actually include a 3G modem - the marketing term rather means that the OEM firmware supports a certain range of 3G/4G modems to be externally connected to USB because it contains drivers for those USB modems! Ignore that, because with OpenWrt ANY router with USB supports 3G/4G hardware ... ;-)

The router is powered through a mini-USB socket stub (5V) and comes with a USB power adapter. hardware revision 3.20 is powered through micro-USB socket.

TP-Link TL-MR3020

Model Version Launch Date Supported since Model Specific Notes
v1.0 2011-12 r29651 AR9331 chipset
v1.4 2012-01 r29763, probably earlier AR9331 chipset
v1.6 2012-03 r30753, probably earlier AR9331 chipset
v1.7 2012-05 12.09-RC1, r32786 AR9331 chipset
v1.8 ?? 12.09-RC1 AR9331-AL1A; internal serial port has no pins, only solder-pads (P1 clearly visible)
v1.9 ?? 14.07 AR9331-AL3A OpenWrt 12.09 do not work at this Version !
v3.0 ?? 18.06.1 snapshots, commit 6bbb2202551be394fead2efd99eb946f846fc63d MT7628NN chipset,The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX (keyboard input).

The current release OEM source code available at: http://www.tp-link.com/resources/gpl/150Router.rar

  • Tiny form factor
    • 5.7 cm x 5.7 cm PCB
    • 6.7 cm x 7.4 cm x 2.2 cm case

Input voltage: The router will function correctly when powered with voltages as low as 3.3 Volts (determined experimentally) instead of 5V USB-Power. Thus, it can be powered directly from one single Li-Ion battery (which usually starts fully charged at 4.2V and has a nominal voltage of 3.7) without the need for an external 5V adapter.

This router is standardly powered via USB at 5V. The voltage regulators' input voltage should be at least between 3.7V - 5.5V, but not over 5.5V. The device will get damaged at too high voltages*. Maximum current draw at 5V is 255mA (Active Download + LAN + WLAN + USBboot), average current draw with WiFi is 125mA, idle is 68mA. Hence the average router power consumption is 0.6W, which is incredibly low.

Power consumption will be higher if a USB device is attached to its USB port! More information and a rough diagram here Interesting webpage with more data about power consumption and so on

Web GUI upload has been confirmed to work with v1.0, v1.4, v1.6, v1.7, v1.8 and 1.9 hardware revisions and requires no serial or TFTP access unless something goes wrong.

Log in to the router's web GUI (default login/password: admin / admin) and flash with openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware image like a regular firmware update.

Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed with proceed with basic configuration as with any fresh OpenWrt install.

See forum if you encounter problems.

At least for model v3 it is possible to upload the OpenWrt image via TFTP without using the serial console. See the Bootloader Recovery for details.

For older models it may be necessary to use the manual TFTP upload method, which requires a serial console connection (see below).

To install OpenWrt from the U-Boot console, you need to install a TFTP server on your computer (tftp-hpa is recommended).

Then download OpenWrt factory image to /srv/tftp (for example), and execute the TFTP server by typing tftpd -l -s /srv/tftp.

Connect the TL-MR3020 using a serial console and power up the TL-MR3020.

After a 1-2 seconds it shows Autobooting in 1 seconds, when displaying this enter tpl immediately.

Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands:

hornet> setenv ipaddr <device-ip, eg. 192.168.1.111>
hornet> setenv serverip <server-ip, eg. 192.168.1.100>
hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000                                                                                                        61
Erased 60 sectors
hornet> cp.b 0x80000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000

done
hornet> bootm 9f020000

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:

#!/bin/bash

# Pass the firmware file to be flashed as the first parameter.
#
# The second curl call will time out, but it's expected. Once the
# script exits you can unplug the ethernet cable and proceed to the
# next router, but KEEP each router ON POWER until the new image is
# fully written! When flashing is done the router automatically
# reboots (as shown by all the leds flashing once).

curl \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.0.254/userRpm/SoftwareUpgradeRpm.htm' \
  --form "Filename=@$1" -F 'Upgrade=Upgrade' \
  http://192.168.0.254/incoming/Firmware.htm  > ans.html
# > /dev/null

sleep 1

session_id=$(sed -n 's/var session_id = \"\(.*\)\".*/\1/p' ans.html)

curl \
  --max-time 2 \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.0.254/incoming/Firmware.htm' \
  http://192.168.0.254/userRpm/FirmwareUpdateTemp.htm?session_id=$session_id  >  /dev/null

If you install openwrt from trunk, the firmware image doesn't include LuCi. You need configure wireless network from telnet to install Luci. You will need already working internet access.

For this example:

Main router:

Ip:         '192.168.2.1'
Ssid:       'Example-network'
Bssid:      '11:11:11:11:11:11'
Encryption: 'WPA2 - PSK'
Key:        'PaSSworD'
Channel:    '9'

( You need fill these by your network properities )

Terminal program:

Putty

After install trunk image wait few minutes then recycle power router and set your computer ip address to:

ip:      192.168.1.2
subnet:  255.255.255.0
gateway: 192.168.1.1

Start your terminal and connect 192.168.1.1 via telnet ( port 23 ). Right now LAN INTERFACE include wireless too. We need to set wireless to WAN interface. Change wireless configuration below example.

vi /etc/config/wireless

config wifi-device  radio0
        option type     mac80211
        option channel  9
        option hwmode   11ng
        option path     'platform/ar933x_wmac'
        option htmode   HT20
        list ht_capab   SHORT-GI-20
        list ht_capab   SHORT-GI-40
        list ht_capab   RX-STBC1
        list ht_capab   DSSS_CCK-40
        option disabled 0
        option txpower 27

config wifi-iface
        option device      radio0
        option network     wan
        option mode        sta
        option ssid        Example-network
        option encryption  psk2
        option bssid       11:11:11:11:11:11
        option key         PaSSworD

Wireless setup completed now we need to get ip WAN interface via main router dhcp server. Set your network config like below example.

vi /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd48:931d:0f42::/48'

config interface 'lan'
        option ifname 'eth0'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option proto    'dhcp'
        option _orig_ifname radio0
        option _orig_bridge false

Reboot your router

reboot

Your terminal session will be closed. You need reconnect to router.

Test your router: If your router is properly connected to the internet you should get something like the below lines:

ping -c3 www.google.com
PING www.google.com (xxx.xxx.xxx.xxx): 56 data bytes
64 bytes from xxx.xxx.xxx.xxx: seq=0 ttl=52 time=88.295 ms
64 bytes from xxx.xxx.xxx.xxx: seq=1 ttl=52 time=87.783 ms
64 bytes from xxx.xxx.xxx.xxx: seq=2 ttl=52 time=87.503 ms

--- www.google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 87.503/87.860/88.295 ms

Now you can install Luci and enable it by below commands:

opkg update
opkg install luci
/etc/init.d/uhttpd enable
/etc/init.d/uhttpd start

Now you can access LuCi interface by 192.168.1.1 with your browser.

By default reset button won't work , as it is only assigned for WPS(in present source code Chaos Calmer 15.0)

*method 1 :

  You can enable that functionality , by manually write script in /etc/hotplog.d/button/buttons file, where you can check the $BUTTON type and according to that write action for reset. 

*method 2 :

  change in 
      file 1 :  openwrt/build_dir/target-mips_34kc_uClibc-0.9.33.2/linux-ar71xx_generic/linux-3.18.36/arch/mips/ath79/mach-tl-mr3020.c
         OR
      file 2 : openwrt/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-mr3020.c 
  
  change wps to reset
      #define TL_MR3020_GPIO_BTN_RESET        11
      static struct gpio_keys_button tl_mr3020_gpio_keys[] __initdata = {
      {
              .desc           = "Reset button",
              .type           = EV_KEY,
              .code           = KEY_RESTART,
              .debounce_interval = TL_MR3020_KEYS_DEBOUNCE_INTERVAL,
              .gpio           = TL_MR3020_GPIO_BTN_RESET,
              .active_low     = 0,
      },
      

TRAC ticket has been raised at https://dev.openwrt.org/ticket/22951 (will delete this line after changes are made in source code)

  • Power on the TL-MR3020
  • When the WPS button starts to blink:
    • on AA (Attitude Adjustment / 12.09) push the WPS button;
    • on BB (Breaking Barrier / trunk) move the sliding switch quickly from one side to the other.
    • on CC (Chaos Calmer) ??? not sure try any switches or buttons ??? repeatedly is fine. 12/11/2015: repeatdly pushing the WPS worked.
  • Do this until the WPS button starts blinking faster.
  • The device is now in Failsafe-Mode
  • Connect the TL-MR3020 to your computer via ethernet

Follow further instructions at: failsafe

Downgraded wrong image ( jff2 instead of squashfs ) cause cant get ip or connect to luci. Failsafe mode still working but firstboot command wont work because it is already on working. You can upload correct firmware and write it with mtd command but failsafe mode can't connect internet. You need to local tftp server to get firmware.

Set your pc ip 192.168.1.10/24 and gateway 192.168.1.1. Download mongoose http server and correct firmware same folder and start mongoose. It will host all files in his path ( if you start it from downloads folder it will host all files in downloads folder )

now we can get firmware via failsafe telnet:

wget http://192.168.1.10:8080/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
mtd -r write /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware
Writing from /tmp/openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin to firmware ...
Rebooting ...
/bin/sh: /sbin/reboot: Input/output error

DONT DO ANYTHING. Just wait and router reboot itself. wait few minutes and you will able to reach Luci via 192.168.1.1.

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

With the TL-MR3020 router, there is a catch: the stock firmware is obtained from the OEM: http://www.tplink.com/en/support/download/?model=TL-MR3020

  • in case the file name of this firmware file does not contain the word “boot” in it, you can simply revert back to original firmware
  • in case the file name of this firmware file does contain the word “boot” in it, you need to cut off parts of the image file before flashing it:

An example of an image file with the word “boot” in it is mr3020nv1_en_3_17_2_up_boot(140408).bin.

Cut the first 0x20200 (that is 131,584 = 257*512) Bytes from original firmware:

dd if=orig.bin of=tplink.bin skip=257 bs=512

You should transfer the firmeware image to the /tmp folder and revert back to original firmware (if availlable you can flash the firmware via the webinterface as well):

Via the safer method using sysupgrade:

sysupgrade /tmp/tplink.bin

Or you use the mtd method:

mtd -r write /tmp/tplink.bin firmware

It is also possible to revert to the stock firmware using the method with tftp described in “Manual Method Using Serial Console and TFTP (Experts)”. (you still need the firmware images without the boot part).

OEM TP-Link firmware for the TL-MR3020 with the boot part removed to revert to the original OEM firmware:

This is confirmed working on a MR3020 v3. You can grab a stock TP-Link that's been snipped of its header, or grab an OpenWRT image with recovery in its name such as “openwrt-ramips-mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recovery.bin”

  • Grab Tftpd64 https://archive.codeplex.com/?p=tftpd64 or any other TFTP server of your choice.
  • Set your ethernet IP to 192.168.0.225/24 , the MR3020 will show up at 192.168.0.2
  • Rename your recovery bin to tp_recovery.bin and point Tftpd64 to the directory your leaving the file in.
  • Plug in your ethernet cable.
  • Hold down the WPS button and power the device on, the 2nd LED will fast trigger after a moment, release button, the TFTP server should report a file being downloaded.
  • Wait until it starts slow flashing and then reboots.

You're back to stock !

Since this part is identical to the one recommended for generic devices, see Basic configuration.

Please read the article flash.layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:

TP-Link MR3020 Flash Layout stock firmware
Layer0 spi0.0: 4096KiB
Layer1 mtd0 mtd1 mtd2 mtd3 mtd4
Size in KiB 128KiB 1024KiB 2816 KiB 64KiB 64KiB
Name u-boot kernel rootfs config art
mountpoint none none / none none
filesystem none none SquashFS none none

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.

The case consists of two parts: a white base and a gray lid. The lid has two snap hinges, one right above the mini USB connector and one on the opposite side about 10 mm left of the “TP-LINK” logo. The lid is additionally glued in place on the underside on all four sides. You can try to pry it open with a thin but very stable blade tool. Start above the ethernet port where the case is not glued, and work your way around the glued corner towards the “3G USB” port (no glue there) until you reach the logo side. You should now be able to peek inside the case on the lose corner.

Next proceed along to the LED side, but beware of the fragile light conductors running straight down beneath the clear plastic. They easily bend or break when you push-in your tool too far. Once three sides are open, you can steadily lift the lid until the remaining side breaks lose and neatly frees the second hinge in the process. If you work carefully and manage not to break either one of the two hinges, the gray lid should snap neatly back into place after some manual cleaning with a cutter knife.

Warning!
Be careful not to scratch PCB traces if you use a flat screwdriver to open the case.
Don't apply downwards pressure on the PCB itself with the tip of the screwdriver. Always point the tip of the screwdriver upwards, practicing a pressure from bottom to top.
I just managed to practically kill an MR3020 because I scratched the ethernet port trace!

tl-mr3020_top-pcb.jpg tl-mr3020_bottom-pcb.jpg

tl-mr3023-v3_pcb_top.jpg tl-mr3023-v3_pcb_bottom.jpg

Pinout
1 2 3 4
TXRXGNDVCC SJ1

Pin 1 is clearly marked on the board.

TP-Link TL-MR3020 Serial Connector

To get a reliable serial connection, you might have to connect a 10k pullup resistor between TX and VCC. This is because the TX pin is connected to a voltage divider (2×5.6k) and a capacitor is put between the real pin and the TX connector. Some serial adaptors might work without the pullup resistor (confirmed for one ST3232-based adaptor), but others definitely require it (confirmed for a FTDI FT232RL-based model).

If you need a serial adaptor, you can build a serial hack adapter (DKU-5, CA-42). Relatively cheap, off-the-shelf and known-to-work alternatives would be SparkFun's FTDI Basic Breakout 3.3V and FTDI Serial Cable 3.3V (the resistor is not needed with this specific cable).

The right settings for accessing the serial console are as follows:

Bits per second: 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

If you are using a Linux or Mac system, the easiest way to connect to the serial console would be the screen command. It comes pre-installed on OS X, but must usually be installed on Linux systems. When installed, just type in a terminal:

screen /dev/[device name] 115200

where [device name] is the name of your serial adaptor, usually tty.usbserial* on Mac and ttyUSB* on Linux. To quit screen, press CTRL-a, followed by CTRL-k, followed by y.

U-Boot Bootloader Console

The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying:

[...]
ag7240_phy_setup 
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

U-Boot accepts several commands. Type help to display the list of available commands.

hornet> help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version

Linux Console

Once the original firmware has booted up completely, you can press return to activate the Linux login prompt.

The password to get a root Shell access is 5up:

TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none)
TL-MR3020 login: root
password: 5up

port.gpio The AR933x platform provides 30 GPIOs. Some of them are used by the router for status LEDs, buttons and other stuff. The table below shows the results of some investigation:

Voltage level at GPIO in output-mode gpioX/value in input-mode when GPIO is:
GPIO Common Name PCB Name gpioX/value=1 gpioX/value=0 Floating Pulled to GND Pulled to Vcc
0 WLAN LED LED4
1 unknown. pulled high R2
2
3
4
5
6 USB Power R107
7 unused Pulled to ground R15
8 USB power R112 2.8V
9
10
11 WPS button
12
13
14
15
16
17 Ethernet LED LED5
18 Sliding Sw.
19
20 Sliding Sw.
21
22
23
24
25
26 WPS LED LED2
27 Internet LED LED3
28
29 unused Pulled to ground R17

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. “leds-gpio” and “gpio-buttons”). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

Example: Reset USB modem

#!/bin/sh
echo "Turning USB power off"
echo 0 > /sys/class/gpio/gpio6/value
echo "Wait 5 sec"
sleep 5
echo "Turning USB power on"
echo 1 > /sys/class/gpio/gpio6/value

The sliding switch has the following truth table:

Mode Switch GPIO18 GPIO20
3G 1 0
WISP 0 1
AP 1 1

How to configure LEDs in general, see the LED section in the led_configuration.

The TL-MR3020 has 5 LEDs:

LED name LED print Internal name Trigger
Power Power symbol N/A (fixed supply) N/A
3G Internet symbol tl-mr3020:green:3g USB:1-1
Wireless LAN WLAN symbol tl-mr3020:green:wlan phy0tpt
LAN LAN symbol tl-mr3020:green:lan netdev:eth0
WPS WPS tl-mr3020:green:wps User preference

hardware.button The TP-Link TL-MR3020 has one button and one sliding switch with three positions:

BUTTON Event
Sliding Switch BTN_0 and BTN_1
WPS Button WPS

The WPS button is located at the top (illuminated by the WPS LED) and can be easily pressed with a finger. The sliding switch is located at the side and has three positions: 3G, WISP, AP.

Sample scripts to read the sliding switch: on boot, on switch change, to change network configurations

Information about bootloader in general and Das U-Boot in particular.

Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future).

This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).

More information:

http://stereo.hq.phicoh.net/~philip/tp-link-mr3020-v3.0.jpg

The serial console is on the pad TP1 and TP2. TP2 is TX (console output) and TP1 is RX (keyboard input).

Swedish FreiFunk community Pjodd have a tutorial for how to put MR3020 in a small metall bowl from IKEA and weather proofing it for outdoor use in order to give the router a directional gain of what seems to be about 5 dBi, allowing for two such installations to communicate with each other at a distance of perhaps 1 km.

http://wiki.pjodd.se/mediawiki/index.php/Blandtenna

tl-mr3020_antenna-rpsmamod.jpg tl-mr3020_antenna-pigtailmod.jpg

If you want to add an external antenna connector or would like to know more about the MR3020 power consumption in different op-states you can find more info Apollo-NG MR3020 External Antenna Hack

TL;DR: The signal dBm and signal distortion level sweetspot is somewhere between txpower 1000 and 1200.

Using region SE iw reg set SE, a 20MHz wide signal on channel 9, I measured the following output power from one of my TL-MR3020 with external antenna:

Signal dBm Noise dB txpower
-6 >41 100
-2 >41 500
0 >41 800
0.5 >41 900
2 1000
3 1200
6 35 1500
7 1800
7.5 28 2700

Where txpower was set using iw phy0 set txpower fixed n and noise is the leaking distortion outside of the 20MHz signal bandwidth.

As a control I made a few measurements on a second TL-MR3020 with external antenna and got the following results:

Signal dBm Noise dB txpower
-2 >41 800
2 40 1200
4 36 1500
6 32 2600

The difference is rather small and probably due to soldering and possibly quality of analogue components on the PCB. Noise level is rather constant between the two tests though.

At the time of these tests the RP-SMA connectors was soldered on rather quick and dirty, and plenty of room was left between the connector and the PCB.

Image of not so well soldered connector

Image of not so well soldered connector

I've now cut the top side connector pins shorter and soldered the connector very close to the PCB instead, plus scratched up a bit more ground on the back side of the PCB, which I also soldered the back side connector ground pins to. Both for a better signal and to make it more sturdy. With some luck this can have increased the signal strength by 1dBm and lowered the signal distortion. Didn't measure again though, just seen that it works better with less noise and greater connection speed.

Image of RP-SMA connector with cut pins

Image of RP-SMA connector with cut pins

Image of RP-SMA with cut pins soldered close to PCB

Image of RP-SMA with cut pins soldered close to PCB

Image of backside of PCB scratch to get more ground

Image of backside of PCB scratch to get more ground. Notice that I've only scratched for one pin on this image. In the end I scratched for both legs and soldered them on there, visible in the next image.

Image of RP-SMA soldered also to ground of backside of PCB

Image of RP-SMA soldered also to ground of backside of PCB

Is is very evident that the greater txpower, the greater amount of noise and distortion in the signal. The signal is very clear around txpower 800, while rather terrible when set to 1800 and more.

Image of analysis of the 20MHz signal at txpower 800 Image of analysis of the 20MHz signal at txpower 800

Image of analysis of the 20MHz signal at txpower 900 Image of analysis of the 20MHz signal at txpower 900

Image of analysis of the 20MHz signal at txpower 1200 Image of analysis of the 20MHz signal at txpower 1200

Image of analysis of the 20MHz signal at txpower 1800 Image of analysis of the 20MHz signal at txpower 1800

Image of analysis of the 20MHz signal at txpower 2700 Image of analysis of the 20MHz signal at txpower 2700

Image of txpower 2700 is analyzed on a different rounter than the previous lower txpower images, mainly visible on the dBm and not the distortion.

Notice the amount of distortion outside of the 20MHz signal at 1800 compared to 1200 or 900. It is hard to say how much of this distortion is also available in the 20MHz signal, my guess is at least as much. This cripples the signal, making a greater txpower probably a worse signal with less speed than one without the distortion.

The txpower sweetspot is therefor estimated to be 1000-1200. This would equal a signal strength of 2-4dBm (1.5-2.5mW). To max that up to the common legal maximum of 100mW ERP you'll need an 18-21dBi antenna. You'll be much better of with a clean signal and a high gain antenna than attempting to crank up the signal strength to a level where it only cripple the signal with distortion.

If you want to add I2C bus to your MR3020, you can use GPIO 7 and 29. Remove R15 and R17, then add pullup between 3.3v and gpio pin.

MR3020 i2C hack

tl-mr3020_i2c_02.jpg

Next step, add this line

i2c-gpio-custom bus0=0,7,29

to /etc/modules.d/99-i2c

and load i2c-gpio-custom

You can find more info in french here http://www.equinoxefr.org/post/2012/11/12/mr3020-et-i2c-avec-les-gpio/

Use GPIO 37 and 43. Remove Power and 3G LEDs.

tl-mr3020_v3_pcb-i2c-pins.jpg

Next add this to startup:

rmmod leds-gpio
insmod i2c-gpio-custom bus0=0,37,43

You can embedded usb hub to add more peripheral to your best router.

I hack a 3$ STOREX usb hub, a 2$ µSD card reader and a 10$ webcam to build a robot with my MR3020.

MR3020 usb hub

More info in french on http://www.equinoxefr.org/post/2012/11/05/projet-de-robot-wifi-torture-dun-routeur-tplink-mr3020/

The USB port on the TL-MR3020 is not compatible with USB devices that use low-speed (1.5Mbps) and only works properly with USB devices that use fast-speed (12Mbps) or high-speed (480Mbps). You can however plug a USB-Serial adapter as long as you plug that through a <$10 USB 2.0 hub that reports itself in dmesg as using high-speed (480Mbps); USB hubs that use fast-speed (even if they are marketed as USB 2.0) do not work in the TL-MR3020 when a low-speed device is connected in one of its ports. While you're at it, use another port of the USB hub to plug in a USB thumb drive and write data there (like serial console logs) so as not to wear out the built-in flash.

You can check if your device is using low, fast or high speed with dmesg command.

See this page for more tips and how to create a serial console server out of your TL-MR3020: http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html

See this forum thread for more info about why the USB port does not work with low speed devices: https://forum.openwrt.org/viewtopic.php?id=39956

U-Boot 1.1.4 (Aug 17 2011 - 09:25:09) AP121-2MB (ar9330) U-boot DRAM: 32 MB led turning on for 1s... id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad ag7240_phy_setup eth0 up : cfg1 0xf cfg2 0x7214 eth1: 00:03:7f:09:0b:ad athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #185 Fri Oct 21 16:26:50 CST 2011 flash_size passed from bootloader = 4 CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29864k/32768k available (1889k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 Whoops! This kernel is for product mr3020 v1.0! bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [F lags: R/O]. msgmni has been set to 58 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered protocol family 24 cmdlinepart partition parsing not available set partition boot set partition kernel set partition rootfs set partition config set partition art set partition ÿ Searching for RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs" 0x0000003e0000-0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0x10215 . ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 116k freed init started: BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary This Board use 2.6.31 xt_time: kernel timezone is -0000 nf_conntrack version 0.5.0 (512 buckets, 5120 max) ip_tables: (C) 2000-2006 Netfilter Core Team insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver, V1.0 PPTP driver version 0.8.3 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory (none) mips #185 Now flash open! Fri Oct 21 16:26:50 CST 2011 (none) (none) login: Now flash open! ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 1:bf1f0006 ATHR_GMAC: 6e:09:80:e4:67:1b ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 ATHR_GMAC: Mac address for unit 0:bf1f0000 ATHR_GMAC: 12:03:cb:60:38:f7 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 athr_gmac_ring_alloc Allocated 640 at 0x81e79800 athr_gmac_ring_alloc Allocated 4032 at 0x81d63000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY...mac 0 athr_gmac_ring_alloc Allocated 640 at 0x81e79400 athr_gmac_ring_alloc Allocated 1536 at 0x81f22000 athr_gmac_mii_setup: MDC check failed Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY...mac 1 device eth0 entered promiscuous mode Now flash open! nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss) Boostrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c0a048a0 arg=81e9e2c0 wlan_vap_delete : enter. vaphandle=0x81e9c000 wlan_vap_delete : exit. vaphandle=0x81e9c000 wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created DES SSID SET=TP-LINK_POCKET_3020_3ABB7A ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 WARNING: Fragmentation with HT mode NOT ALLOWED!! device ath0 entered promiscuous mode br0: port 2(ath0) entering forwarding state ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1 br0: port 2(ath0) entering disabled state DES SSID SET=TP-LINK_POCKET_3020_3ABB7A br0: port 2(ath0) entering forwarding state gpio_tricolor_led_write 699 green_led_onoff = 1 TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none) TL-MR3020 login:


 TL-MR3020 Unit Underside TL-MR3020 Bottom Info TL-MR3020 Bottom Info Closeup TL-MR3020 Side Info TL-MR3020 PSU UK

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by 127.0.0.1