TP-Link TL-MR3040
A portable router with an onboard 2000mAh rechargeable_battery. See also TP-Link TL-MR10U, TP-Link TL-MR11U, TP-Link TL-MR12U, TP-Link TL-MR13U and TP-Link TL-MR3020, TP-Link TL-WR703N.
Although it is marketed as a “3G/4G router”, the TL-MR3040 does not include a 3G/4G modem. It simply means that the OEM firmware and GUI support a certain range of USB 3G modems, but, OpenWrt supports 3G modems too.
Supported Versions
| Version/Model | Launch Date | OpenWrt Version Supported | Model Specific Notes | Hardware differences |
|---|---|---|---|---|
| v1.0 | May 2012 | Trunk R31845 | Confirmed working | - |
| v2.0 | January 2013 | Trunk R37964 | Confirmed working on v2.1 hardware | Mode Switch button |
| v2.2 | October 2013 | Confirmed working on v2.2 hardware | Mode Switch button | |
| v2.3 | 2014 | Chaos Calmer 15.05 | Confirmed working on v2.3 hardware | |
| v2.4 | Dec 2014 | Barrier Breaker | Confirmed working on v2.4 hardware | B.A.T.M.A.N. -adv also supported |
| v2.5 | ? | Chaos Calmer 15.05 | Confirmed working on v2.5 hardware | |
| v2.5 | ? | Chaos Calmer 17.01.5 | Confirmed working on v2.5 hardware |
Hardware Highlights
TL-MR3040 and TL-MR11U differences
Althought TL-MR3040 and MR11U seem similar on the outside, the inside isn´t that similar. Here are the differences:
- MR11U is chinese only
- MR3040(v1.0/v2.0) doesn´t have QSS button
- USP_POWER GPIO is diferrent
- Some buttons are on different sides with different looks
- Also the layers printed on the PCB are different and also some connections
Installation
Version 1.0
- Download the Barrier Breaker stable release from here
Method Using Web GUI (Recommended)
As with most TP-Link Routers this one can be flashed using the TP-Link Webinterface. Connect to the TL-MR3040 router via Ethernet cable at IP address 192.168.0.1, login to the router's web GUI (default login/password: admin / admin), and overwrite the factory firmware by installing the openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin like a regular firmware update.
Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed with basic configuration as with any fresh OpenWrt install.
Manual Flash under U-Boot Serial Console
- To install OpenWrt from the U-Boot console, you need to install a TFTP server on your computer.
- By default the server is set to 192.168.0.100, you can check detail by 'printenv'
- The serial layout is p1: →serial_console
- Setup serial console 115200 8n1, for example: screen /dev/ttyUSB0 115200 ixoff
Power up the TL-MR3040, after a 1-2 seconds U-Boot announces “Autobooting in 1 seconds”, when displaying this enter tpl immediately.
Autobooting in 1 seconds [type tpl here]
You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands:
hornet> tftpboot 0x81000000 openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin
Using eth0 device
TFTP from server 192.168.0.100; our IP address is 192.168.0.1
Filename 'openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000
First 0x2 last 0x3d sector size 0x10000 61
Erased 60 sectors
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000
done
hornet> bootm 9f020000
Version 2.x
Method Using Web GUI (Recommended)
Same as for v1.0 (that is, log into the OEM web interface, usually at http://192.168.0.1/, and update the firmware via this interface), but remember to use the v2 firmware image instead of the v1 image. Default username/password: admin/admin
The OEM Web GUI may complain Please choose a file to upgrade due to the length of the filename. If this is the case, rename the openwrt-xx.xx.xx-ar71xx-generic-tl-mr3040-v2-squashfs-factory.bin firmware filename to openwrt.bin, select the file for upload in the Web GUI, and click Upload.
Manual Flash under U-Boot Serial Console
Same as for v1.0, but remember to use the v2 firmware image (openwrt-ar71xx-generic-tl-mr3040-v2-squashfs-factory.bin) instead of the v1 image.
Upgrading OpenWrt
Failsafe Mode
- Switch on the router
- Wait almost 5 sec
- Press the “Reset” for ~3sec
- The device is now in Failsafe-Mode
- You may access it by using telnet 192.168.1.1/24 or serial
Keep in mind: The LEDs won't flash in Failsafe Mode!
Restoring Original Firmware
If you have SSH access:
- It is possible to flash factory firmware (or other firmware like DD-WRT) via the “mtd” command as documented in the generic instructions:
- The firmware must be 3,932,160 bytes
- Get the file into /tmp on the router via wget from the web or scp from your PC
- Command is: “mtd -r write /tmp/filename.bin firmware”
- HOWEVER, some of the firmware downloaded from TP-LINK are too big (4,063,744 bytes) as they include the “boot” along with the firmware (usually the filename says “boot”, e.g. mr3040v2_en_3_14_4_up_boot(121017).bin).
- Those extra bytes can be removed before flashing with:
dd if=original_filename.bin of=modified_filename.bin skip=257 bs=512
Afterwards, the file should be the correct size for flashing.
- This command removes the first 128.5KB (0x20200) from the file. Please note: There is a risk that's not the proper location for all files. You can double check by viewing address 0x20200 in a hex editor: Just prior to 0x20200 you should see a large block of 00's. At 0x20200 you should have a “01” followed by a few 00's and then “TP-LINK”). On Linux, use the following command to view the data just prior to and at 0x20200:
hexdump -C original_filename.bin | grep 00020200 -B 3
Example output:
0000bcb0 61 0a ff ff ff ff ff ff ff ff ff ff ff ff ff ff |a...............| 0000bcc0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00020200 01 00 00 00 54 50 2d 4c 49 4e 4b 20 54 65 63 68 |....TP-LINK Tech|
- references:
- When flashing with mtd, if you receive an error such as “failed to erase block”, then DO NOT REBOOT your router. Instead, flash a known good firmware of the proper size (e.g. flash the sysupgrade bin for the OpenWrt version you most recently had)
If you don't have SSH access (router bricked, etc):
- The process is similar to flash OpenWrt with U-boot serial console
- Download the original image
- Don´t forget to enter “tpl” as soon as U-Boot announces “Autobooting in 1 seconds”
hornet> tftpboot 0x81000000 mr3040v1_en_3_12_11_up(120328).bin ... hornet> erase 0x9f020000 +0x3c0000 ... hornet> cp.b 0x81000000 0x9f020000 0x3c0000 ... hornet> bootm 9f020000
Basic Configuration
Since this part is identical to generic devices, see Basic configuration.
Original Flash Layout
Please read the article Flash Layout for a better understanding. It contains a couple of explanations. Then let's have a view at flash layout of this particular device:
| TP-Link MR3040 Flash Layout stock firmware | |||||
|---|---|---|---|---|---|
| Layer0 | spi0.0: 4096KiB | ||||
| Layer1 | mtd0 | mtd1 | mtd2 | mtd3 | mtd4 |
| Size in KiB | 128KiB | 1024KiB | 2816 KiB | 64KiB | 64KiB |
| Name | u-boot | kernel | rootfs | config | art |
| mountpoint | none | none | / | none | none |
| filesystem | none | none | SquashFS | none | none |
ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.
Hardware
Opening the device
Remove back cover, remove battery. Unscrew two screws, open case in the corner next to the ethernet port (there is a small triangle here). Push a screwdriver into the hole next to the battery (closest to ethernet port) and pull cover until it snaps open. Next push in the screwdriver in the next corner next to the battery.
Info
| IC | Datasheet | |
|---|---|---|
| Processor | AR7240 | atheros.ar7240.pdf |
| Flash ROM | Spansion S25FL032P | http://www.spansion.com/Support/Datasheets/S25FL032P_00.pdf |
| SDRAM | Zentel A3S56D40FTP | http://www.kean.com.au/oshw/WR703N/teardown/Zentel%20A3S56D40FTP%20DDR%20256Mb%20SDRAM.pdf |
| Chipset (Wi-Fi controller) | AR9331 | https://www.4project.co.il/documents/doc_4000_3583.pdf |
Serial Console
Pinout
| 1 | 2 | 3 | 4 |
|---|---|---|---|
| TX | RX | GND | VCC |
Pin 1 is clearly marked on the board. Careful, on ver:2.5 there is a white mark “P1” printed on the board, next to pin 4 (this almost tripped me up, so I write a bit more prose). Pin 1 is the one with the square metal solder surface around the hole. Pin 1 has a distinct white box printed around it, while pins 2 - 4 share another printed box. You can double-check by looking at pin 3 with a magnifying glass: you can clearly see how the solder surface around the hole is directly connected in all four directions to the wide GND area on the board.
The right settings for accessing the serial console are as follows:
Bits per second: 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None
U-Boot Bootloader Console
The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying:
[...] ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds [type tpl here]
U-Boot accepts several commands. Type help to display the list of available commands.
Linux Console
Once the original firmware has booted up completely, you can press return to activate the Linux login prompt.
TL-MR3040 login: root password: 5up
Photos (v1.0)
Photos (v2.1)
Hardware info (v2.1)
The stock firmware has a web-based command line interface (located at http://192.168.0.1/userRpmNatDebugRpm26525557/linux_cmdline.html - username/password is osteam/5up). The following info was obtained via this web interface.
# cat /proc/version& Linux version 2.6.31--LSDK-9.2.0.312 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #45 Wed Oct 17 17:14:17 CST 2012
# cat /proc/cpuinfo & system type : Atheros AR9330 (Hornet) processor : 0 cpu model : MIPS 24Kc V7.4 BogoMIPS : 266.24 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ffb] ASEs implemented : mips16 shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not available
# cat /proc/interrupts&
CPU0
2: 226967 dummy wifi0
3: 0 MIPS ehci_hcd:usb1
4: 0 MIPS eth1
5: 26826 MIPS eth0
6: 0 MIPS cascade
7: 886122 MIPS timer
18: 0 AR7240 MISC cascade
19: 48 AR7240 MISC serial
28: 37 AR7240 MISC gmac link intr
43: 0 AR7240 GPIO RESTORE_FACTORY_DEFAULT
53: 0 AR7240 GPIO Watchdog Reset
ERR: 0
# ls /proc 1 42 533 diskstats pagetypeinfo 147 43 534 driver partitions 150 44 535 execdomains self 151 45 538 filesystems simple_config 152 5 542 fs slabinfo 155 505 549 interrupts softirqs 156 506 572 iomem stat 16 507 66 ioports sys 162 508 8 irq sysvipc 165 511 93 kallsyms timer_list 168 512 ath_gmac_stat kmsg tty 2 515 athdebug loadavg uptime 25 516 athversion locks version 3 527 buddyinfo meminfo vmallocinfo 324 528 bus misc vmstat 361 529 cmdline modules zoneinfo 384 530 cpuinfo mounts 385 531 crypto mtd 4 532 devices net
# cat /proc/meminfo& MemTotal: 29992 kB MemFree: 11060 kB Buffers: 2236 kB Cached: 6860 kB SwapCached: 0 kB Active: 4364 kB Inactive: 6932 kB Active(anon): 2200 kB Inactive(anon): 0 kB Active(file): 2164 kB Inactive(file): 6932 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 2224 kB Mapped: 1952 kB Slab: 4908 kB SReclaimable: 456 kB SUnreclaim: 4452 kB PageTables: 232 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 14996 kB Committed_AS: 5600 kB VmallocTotal: 1048404 kB VmallocUsed: 2116 kB VmallocChunk: 1037128 kB
# cat /proc/softirqs&
CPU0
HI: 0
TIMER: 894576
NET_TX: 1114
NET_RX: 30910
BLOCK: 0
TASKLET: 194810
SCHED: 0
HRTIMER: 0
RCU: 29923
# cat /proc/devices& Character devices: 1 mem 4 ttyS 5 /dev/tty 5 /dev/console 5 /dev/ptmx 10 misc 13 input 21 sg 77 AR7240_GPIOC 90 mtd 108 ppp 128 ptm 136 pts 180 usb 189 usb_device 238 ar7240_gpio_chrdev 239 ar7240_flash_chrdev Block devices: 259 blkext 8 sd 31 mtdblock 65 sd 66 sd 67 sd 68 sd 69 sd 70 sd 71 sd 128 sd 129 sd 130 sd 131 sd 132 sd 133 sd 134 sd 135 sd
# cat /proc/timer_list& Timer List Version: v0.4 HRTIMER_MAX_CLOCK_BASES: 2 now at 3623494191688 nsecs cpu: 0 clock 0: .base: 80247490 .index: 0 .resolution: 4000250 nsecs .get_time: ktime_get_real active timers: clock 1: .base: 802474b8 .index: 1 .resolution: 4000250 nsecs .get_time: ktime_get active timers: #0: <80ddfea0>, hrtimer_wakeup, S:01 # expires at 3623587145038-3623587195038 nsecs [in 92953350 to 93003350 nsecs] #1: <80ec3ea0>, hrtimer_wakeup, S:01 # expires at 3623592058218-3623592108218 nsecs [in 97866530 to 97916530 nsecs] #2: <80dcfea0>, hrtimer_wakeup, S:01 # expires at 3623692053433-3623692103433 nsecs [in 197861745 to 197911745 nsecs] #3: <81c63ea0>, hrtimer_wakeup, S:01 # expires at 3623692078218-3623692128218 nsecs [in 197886530 to 197936530 nsecs] #4: <81c87ea0>, hrtimer_wakeup, S:01 # expires at 3623776060908-3623776110908 nsecs [in 281869220 to 281919220 nsecs] #5: <81c89ea0>, hrtimer_wakeup, S:01 # expires at 3623776082598-3623776132598 nsecs [in 281890910 to 281940910 nsecs] #6: <80eabea0>, hrtimer_wakeup, S:01 # expires at 3623776449078-3623776499078 nsecs [in 282257390 to 282307390 nsecs] #7: <80dd7ea0>, hrtimer_wakeup, S:01 # expires at 3624452067673-3624452117673 nsecs [in 957875985 to 957925985 nsecs] #8: <80eadea0>, hrtimer_wakeup, S:01 # expires at 3624452094108-3624452144108 nsecs [in 957902420 to 957952420 nsecs] #9: <80e9fea0>, hrtimer_wakeup, S:01 # expires at 3624452139538-3624452189538 nsecs [in 957947850 to 957997850 nsecs] #10: <80ec1ea0>, hrtimer_wakeup, S:01 # expires at 3624456056338-3624456106338 nsecs [in 961864650 to 961914650 nsecs] #11: <81c29ad8>, hrtimer_wakeup, S:01 # expires at 3625300039373-3625302039369 nsecs [in 1805847685 to 1807847681 nsecs] #12: <80c21ea0>, hrtimer_wakeup, S:01 # expires at 3625356006158-3625356056158 nsecs [in 1861814470 to 1861864470 nsecs] #13: <80e89ea0>, hrtimer_wakeup, S:01 # expires at 3626220007808-3626220057808 nsecs [in 2725816120 to 2725866120 nsecs] #14: <81c49ea0>, hrtimer_wakeup, S:01 # expires at 3629000002848-3629000052848 nsecs [in 5505811160 to 5505861160 nsecs] #15: <80cdfa40>, hrtimer_wakeup, S:01 # expires at 3632620073878-3632630073853 nsecs [in 9125882190 to 9135882165 nsecs] #16: <80edfa40>, hrtimer_wakeup, S:01 # expires at 3634616067468-3634646067446 nsecs [in 11121875780 to 11151875758 nsecs] #17: <81c5fea0>, hrtimer_wakeup, S:01 # expires at 3678339169738-3678339219738 nsecs [in 54844978050 to 54845028050 nsecs] #18: <81c6bea0>, hrtimer_wakeup, S:01 # expires at 3678680084893-3678680134893 nsecs [in 55185893205 to 55185943205 nsecs] #19: <81c53a40>, hrtimer_wakeup, S:01 # expires at 7217260376833-7217260426833 nsecs [in 3593766185145 to 3593766235145 nsecs] Tick Device: mode: 0 Per CPU device: 0 Clock Event Device: MIPS max_delta_ns: 2147483647 min_delta_ns: 3840 mult: 858993459 shift: 32 mode: 3 next_event: 3623496000000 nsecs set_next_event: mips_next_event set_mode: mips_set_clock_mode event_handler: tick_handle_periodic
# /sbin/lsmod Module Size Used by umac 630496 0 - Live 0xc0a5e000 ath_dev 214688 1 umac, Live 0xc094a000 (P) ath_rate_atheros 32512 1 ath_dev, Live 0xc08f3000 (P) ath_hal 369264 2 umac,ath_dev, Live 0xc0886000 (P) asf 9376 3 umac,ath_dev,ath_hal, Live 0xc080e000 (P) adf 14512 3 umac,ath_dev,ath_hal, Live 0xc07ff000 nf_nat_rtsp 5328 0 - Live 0xc073d000 nf_conntrack_rtsp 7136 1 nf_nat_rtsp, Live 0xc0731000 nf_nat_h323 6720 0 - Live 0xc0720000 nf_nat_tftp 1280 0 - Live 0xc0715000 nf_conntrack_tftp 4192 1 nf_nat_tftp, Live 0xc070b000 nf_nat_ftp 2768 0 - Live 0xc0701000 nf_conntrack_ftp 7216 1 nf_nat_ftp, Live 0xc06f6000 nf_nat_pptp 2576 0 - Live 0xc06eb000 nf_conntrack_pptp 5904 1 nf_nat_pptp, Live 0xc06e0000 tp_domain 4352 0 - Live 0xc06c1000 athrs_gmac 54048 0 - Live 0xc02a3000 statistics 87056 0 - Live 0xc0273000 wlan_warn 2976 0 - Live 0xc0268000 pptp 10432 0 - Live 0xc025f000 pppol2tp 27760 0 - Live 0xc024d000 br_filter 1232 0 - Live 0xc023b000 ts_kmp 2208 1 - Live 0xc0232000 cls_fw 5088 0 - Live 0xc0227000 cls_basic 4944 0 - Live 0xc021b000 sch_sfq 6384 0 - Live 0xc020f000 sch_prio 5360 0 - Live 0xc0203000 sch_htb 18000 0 - Live 0xc01f4000 ipt_TRIGGER 3872 0 - Live 0xc01e5000 ipt_REJECT 2992 0 - Live 0xc01db000 ipt_REDIRECT 1520 0 - Live 0xc01d1000 ipt_MASQUERADE 2400 3 - Live 0xc01c8000 iptable_nat 4720 1 - Live 0xc01bd000 iptable_filter 2352 1 - Live 0xc01b2000 ip_tables 11824 2 iptable_nat,iptable_filter, Live 0xc01a6000 nf_nat_proto_gre 1984 1 nf_nat_pptp, Live 0xc0199000 nf_nat 15904 10 nf_nat_rtsp,nf_nat_h323,nf_nat_tftp,nf_nat_ftp,nf_nat_pptp,ipt_TRIGGER,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat,nf_nat_proto_gre, Live 0xc018d000 nf_conntrack_ipv4 13184 9 iptable_nat,nf_nat, Live 0xc017c000 nf_defrag_ipv4 1648 1 nf_conntrack_ipv4, Live 0xc016e000 xt_state 1856 6 - Live 0xc0165000 xt_conntrack 4544 0 - Live 0xc015b000 nf_conntrack_h323 47328 1 nf_nat_h323, Live 0xc0146000 nf_conntrack_proto_gre 4976 1 nf_conntrack_pptp, Live 0xc012f000 nf_conntrack 59008 18 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_h323,nf_nat_tftp,nf_conntrack_tftp,nf_nat_ftp,nf_conntrack_ftp,nf_nat_pptp,nf_conntrack_pptp,ipt_TRIGGER,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4,xt_state,xt_conntrack,nf_conntrack_h323,nf_conntrack_proto_gre, Live 0xc0116000 ipt_multiurl 1936 0 - Live 0xc00fa000 xt_time 2704 0 - Live 0xc00f1000 xt_string 2208 0 - Live 0xc00e7000 xt_multiport 2848 0 - Live 0xc00dd000 xt_mac 1376 0 - Live 0xc00d3000 xt_iprange 2128 0 - Live 0xc00ca000 xt_comment 1296 1 - Live 0xc00c1000 xt_TCPMSS 3264 1 - Live 0xc00b8000 xt_MARK 1888 0 - Live 0xc00ae000 xt_tcpudp 2784 14 - Live 0xc00a5000 x_tables 16480 19 wlan_warn,ipt_TRIGGER,ipt_REJECT,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat,ip_tables,xt_state,xt_conntrack,ipt_multiurl,xt_time,xt_string,xt_multiport,xt_mac,xt_iprange,xt_comment,xt_TCPMSS,xt_MARK,xt_tcpudp, Live 0xc0097000
# cat /proc/modules& umac 630496 0 - Live 0xc0a5e000 ath_dev 214688 1 umac, Live 0xc094a000 (P) ath_rate_atheros 32512 1 ath_dev, Live 0xc08f3000 (P) ath_hal 369264 2 umac,ath_dev, Live 0xc0886000 (P) asf 9376 3 umac,ath_dev,ath_hal, Live 0xc080e000 (P) adf 14512 3 umac,ath_dev,ath_hal, Live 0xc07ff000 nf_nat_rtsp 5328 0 - Live 0xc073d000 nf_conntrack_rtsp 7136 1 nf_nat_rtsp, Live 0xc0731000 nf_nat_h323 6720 0 - Live 0xc0720000 nf_nat_tftp 1280 0 - Live 0xc0715000 nf_conntrack_tftp 4192 1 nf_nat_tftp, Live 0xc070b000 nf_nat_ftp 2768 0 - Live 0xc0701000 nf_conntrack_ftp 7216 1 nf_nat_ftp, Live 0xc06f6000 nf_nat_pptp 2576 0 - Live 0xc06eb000 nf_conntrack_pptp 5904 1 nf_nat_pptp, Live 0xc06e0000 tp_domain 4352 0 - Live 0xc06c1000 athrs_gmac 54048 0 - Live 0xc02a3000 statistics 87056 0 - Live 0xc0273000 wlan_warn 2976 0 - Live 0xc0268000 pptp 10432 0 - Live 0xc025f000 pppol2tp 27760 0 - Live 0xc024d000 br_filter 1232 0 - Live 0xc023b000 ts_kmp 2208 1 - Live 0xc0232000 cls_fw 5088 0 - Live 0xc0227000 cls_basic 4944 0 - Live 0xc021b000 sch_sfq 6384 0 - Live 0xc020f000 sch_prio 5360 0 - Live 0xc0203000 sch_htb 18000 0 - Live 0xc01f4000 ipt_TRIGGER 3872 0 - Live 0xc01e5000 ipt_REJECT 2992 0 - Live 0xc01db000 ipt_REDIRECT 1520 0 - Live 0xc01d1000 ipt_MASQUERADE 2400 3 - Live 0xc01c8000 iptable_nat 4720 1 - Live 0xc01bd000 iptable_filter 2352 1 - Live 0xc01b2000 ip_tables 11824 2 iptable_nat,iptable_filter, Live 0xc01a6000 nf_nat_proto_gre 1984 1 nf_nat_pptp, Live 0xc0199000 nf_nat 15904 10 nf_nat_rtsp,nf_nat_h323,nf_nat_tftp,nf_nat_ftp,nf_nat_pptp,ipt_TRIGGER,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat,nf_nat_proto_gre, Live 0xc018d000 nf_conntrack_ipv4 13184 9 iptable_nat,nf_nat, Live 0xc017c000 nf_defrag_ipv4 1648 1 nf_conntrack_ipv4, Live 0xc016e000 xt_state 1856 6 - Live 0xc0165000 xt_conntrack 4544 0 - Live 0xc015b000 nf_conntrack_h323 47328 1 nf_nat_h323, Live 0xc0146000 nf_conntrack_proto_gre 4976 1 nf_conntrack_pptp, Live 0xc012f000 nf_conntrack 59008 18 nf_nat_rtsp,nf_conntrack_rtsp,nf_nat_h323,nf_nat_tftp,nf_conntrack_tftp,nf_nat_ftp,nf_conntrack_ftp,nf_nat_pptp,nf_conntrack_pptp,ipt_TRIGGER,ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4,xt_state,xt_conntrack,nf_conntrack_h323,nf_conntrack_proto_gre, Live 0xc0116000 ipt_multiurl 1936 0 - Live 0xc00fa000 xt_time 2704 0 - Live 0xc00f1000 xt_string 2208 0 - Live 0xc00e7000 xt_multiport 2848 0 - Live 0xc00dd000 xt_mac 1376 0 - Live 0xc00d3000 xt_iprange 2128 0 - Live 0xc00ca000 xt_comment 1296 1 - Live 0xc00c1000 xt_TCPMSS 3264 1 - Live 0xc00b8000 xt_MARK 1888 0 - Live 0xc00ae000 xt_tcpudp 2784 14 - Live 0xc00a5000 x_tables 16480 19 wlan_warn,ipt_TRIGGER,ipt_REJECT,ipt_REDIRECT,ipt_MASQUERADE,iptable_nat,ip_tables,xt_state,xt_conntrack,ipt_multiurl,xt_time,xt_string,xt_multiport,xt_mac,xt_iprange,xt_comment,xt_TCPMSS,xt_MARK,xt_tcpudp, Live 0xc0097000
# ls /dev ar7100_flash_chrdev ram0 ttyS1 ar7100_gpio_chrdev random ttyS2 caldata tty ttyUSB0 console tty0 ttyUSB1 dk0 tty1 ttyUSB10 kmem tty2 ttyUSB11 mem ttyACM0 ttyUSB12 mtd0 ttyACM1 ttyUSB13 mtdblock0 ttyACM10 ttyUSB14 mtdblock1 ttyACM11 ttyUSB15 mtdblock2 ttyACM12 ttyUSB2 mtdblock3 ttyACM13 ttyUSB3 mtdblock4 ttyACM14 ttyUSB4 mtdblock5 ttyACM15 ttyUSB5 mtdblock6 ttyACM2 ttyUSB6 mtdr0 ttyACM3 ttyUSB7 null ttyACM4 ttyUSB8 ppp ttyACM5 ttyUSB9 ptmx ttyACM6 ttyp0 pts ttyACM7 ttyp1 ptyp0 ttyACM8 ttyp2 ptyp1 ttyACM9 urandom ptyp2 ttyS0 zero
# /sbin/ifconfig
ath0 Link encap:Ethernet HWaddr F8:1A:67:5B:D9:7C
UP BROADCAST RUNNING MULTICAST MTU:2290 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:456 errors:0 dropped:2656 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:200184 (195.4 KiB)
br0 Link encap:Ethernet HWaddr F8:1A:67:5B:D9:7C
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:22657 errors:0 dropped:0 overruns:0 frame:0
TX packets:26997 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2368073 (2.2 MiB) TX bytes:19011533 (18.1 MiB)
eth0 Link encap:Ethernet HWaddr F8:1A:67:5B:D9:7B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:22683 errors:0 dropped:4 overruns:0 frame:0
TX packets:29239 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2779389 (2.6 MiB) TX bytes:19273038 (18.3 MiB)
eth1 Link encap:Ethernet HWaddr F8:1A:67:5B:D9:7D
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2004 errors:0 dropped:0 overruns:0 frame:0
TX packets:2004 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:156312 (152.6 KiB) TX bytes:156312 (152.6 KiB)
wifi0 Link encap:Ethernet HWaddr F8:1A:67:5B:D9:7C
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:174 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:2 Memory:b8100000-b811ffff
# cat /proc/partitions& major minor #blocks name 31 0 128 mtdblock0 31 1 1024 mtdblock1 31 2 2816 mtdblock2 31 3 64 mtdblock3 31 4 64 mtdblock4
# cat /proc/diskstats& 31 0 mtdblock0 0 0 0 0 0 0 0 0 0 0 0 31 1 mtdblock1 0 0 0 0 0 0 0 0 0 0 0 31 2 mtdblock2 82 2127 4418 1028 0 0 0 0 0 1028 1028 31 3 mtdblock3 0 0 0 0 0 0 0 0 0 0 0 31 4 mtdblock4 1 0 8 0 0 0 0 0 0 0 0
# df Filesystem 1k-blocks Used Available Use% Mounted on /dev/mtdblock2 2688 2688 0 100% /
# cat /proc/pagetypeinfo& Page block order: 10 Pages per block: 1024 Free pages count per migrate type at order 0 1 2 3 4 5 6 7 8 9 10 Node 0, zone Normal, type Unmovable 3 2 2 0 1 1 1 1 0 0 0 Node 0, zone Normal, type Reclaimable 0 1 1 1 0 0 0 1 1 1 0 Node 0, zone Normal, type Movable 1 1 1 1 0 1 1 0 0 1 0 Node 0, zone Normal, type Reserve 0 0 0 0 0 0 0 0 0 0 1 Node 0, zone Normal, type Isolate 0 0 0 0 0 0 0 0 0 0 0 Number of blocks type Unmovable Reclaimable Movable Reserve Isolate Node 0, zone Normal 2 1 4 1 0
# cat /proc/vmstat& nr_free_pages 2807 nr_inactive_anon 0 nr_active_anon 521 nr_inactive_file 1733 nr_active_file 541 nr_unevictable 0 nr_mlock 0 nr_anon_pages 527 nr_mapped 488 nr_file_pages 2274 nr_dirty 0 nr_writeback 0 nr_slab_reclaimable 114 nr_slab_unreclaimable 1108 nr_page_table_pages 52 nr_unstable 0 nr_bounce 0 nr_vmscan_write 0 nr_writeback_temp 0 pgpgin 2213 pgpgout 0 pswpin 0 pswpout 0 pgalloc_normal 75985 pgalloc_movable 0 pgfree 78792 pgactivate 542 pgdeactivate 0 pgfault 71708 pgmajfault 78 pgrefill_normal 0 pgrefill_movable 0 pgsteal_normal 0 pgsteal_movable 0 pgscan_kswapd_normal 0 pgscan_kswapd_movable 0 pgscan_direct_normal 0 pgscan_direct_movable 0 pginodesteal 0 slabs_scanned 0 kswapd_steal 0 kswapd_inodesteal 0 pageoutrun 0 allocstall 0 pgrotated 0 unevictable_pgs_culled 0 unevictable_pgs_scanned 0 unevictable_pgs_rescued 0 unevictable_pgs_mlocked 0 unevictable_pgs_munlocked 0 unevictable_pgs_cleared 0 unevictable_pgs_stranded 0 unevictable_pgs_mlockfreed 0
# cat /proc/zoneinfo&
Node 0, zone Normal
pages free 2771
min 180
low 225
high 270
scanned 0
spanned 8192
present 8128
nr_free_pages 2771
nr_inactive_anon 0
nr_active_anon 550
nr_inactive_file 1733
nr_active_file 541
nr_unevictable 0
nr_mlock 0
nr_anon_pages 556
nr_mapped 488
nr_file_pages 2274
nr_dirty 0
nr_writeback 0
nr_slab_reclaimable 114
nr_slab_unreclaimable 1107
nr_page_table_pages 58
nr_unstable 0
nr_bounce 0
nr_vmscan_write 0
nr_writeback_temp 0
protection: (0, 0)
pagesets
cpu: 0
count: 0
high: 0
batch: 1
all_unreclaimable: 0
prev_priority: 12
start_pfn: 0
inactive_ratio: 1
TL-MR3040 Reverse Engineering
The TL-MR3040 has been torn down by Jarocks, which was very useful to check the pinout. The investigation was complete thanks to doiga, also check the forum
GPIOs
The AR933x platform provides 28 GPIOs, some of them are used by the router for status LEDs, buttons and other stuff.
The TL-MR3040 provides 3 free GPIOs.
The table below shows the results of the investigation, based on the AR9331 datasheet:
| GPIO | Available | AR9331 Pin | Description | desc.(tested on a V2 board) |
|---|---|---|---|---|
| 0 | R8 | A78 | Must have 0 value during bootstrap* | |
| 1 | R11 | A77 | Must have 1 value during bootstrap | |
| 2 | SPI_CS_0 | B49 | Used by SPI Flash | |
| 3 | SPI_CLK | B51 | Used by SPI Flash | |
| 4 | SPI_MOSI | B50 | Used by SPI Flash | |
| 5 | SPI_MISO | A57 | Used by SPI Flash | |
| 6 | NC | B46 | (JTAG TDI - unused) | |
| 7 | NC | A54 | (JTAG TDO - unused) | |
| 8 | NC | A52 | (JTAG TMS - unused) | |
| 9 | SIN | B68 | Serial INPUT (Rx) | |
| 10 | SOUT | A79 | Serial OUTPUT (Tx) | |
| 11 | RESET SW | B48 | Soft Reset Switch | |
| 12 | R84 | A56 | Must have 0 value during bootstrap | |
| 13 | R12 | B66 | Must have 1 value during bootstrap | |
| 14 | R9 | A76 | unused Pulled to ground | |
| 15 | R10 | B65 | unused Pulled to ground | |
| 16 | R13 | A75 | Must have 0 value during bootstrap | |
| 17 | R87/LED2 | B64 | LAN LED | |
| 18 | USB_POWER | A28 | Control USB Host Power | |
| 19 | NC | slide switch partA | ||
| 20 | R15 | A27 | unused Pulled to ground | slide switch partB |
| 21 | NC | |||
| 22 | NC | |||
| 23 | NC | |||
| 24 | NC | |||
| 26 | R85/LED3 | A51 | Wireless LAN LED | |
| 27 | R83/LED1 | B44 | 3G LED | |
| 28 | N/A | A74 | Must have 0 value during bootstrap |
*GPIO_0 can be floating (i.e. resistors removed) during boostrap and the router still boots! TESTED!!!
how to use GPIO 19,20
- R27 & R17 are 10k pullup resistors, should be desoldered in order to use GPIO19,20 as output
- if you don't want to desolder the switch, then disassemble it, and solder a pin header on the solder side of pcb
- truth table for slide sw1 and slide sw 2
| pin 19 | pin 20 | sw state |
|---|---|---|
| 0 | 1 | 3G/4G |
| 1 | 0 | WISP |
| 1 | 1 | AP |
To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project.
LEDs
How to configure LEDs in general, see the LED section in the led_configuration.
The TL-MR3040 has 5 LEDs:
| LED name | LED color | LED print | Internal name | Trigger |
|---|---|---|---|---|
| Power (2 LEDs) | Green/Red | Power/Charge symbol | N/A (fixed supply) | N/A |
| LAN | Green | LAN symbol | tp-link:green:lan | netdev:eth0 |
| Wireless LAN | Green | WLAN symbol | tp-link:green:wlan | phy0tpt |
| 3G | Green | Internet symbol | tp-link:green:3g | USB:1-1 |
USB Port
Like other devices using the ar933x platform, this model suffers from problems when directly connecting USB 1.1 devices (specified for low speed or full speed; normally serial adapters). These problems can be circumvented by using an USB 2.0 (passive or externally powered) hub between the router and the USB devices. More information in the forum.
There are USB modems which draw more power than this router can deliver (especially when their often integrated sd-card-reader is used), which can lead to the modem to stop working correctly. An externally powered usb hub can be used to resolve this issue.
Hardware slide switch (v2)
→ hardware.button The TP-Link TL-MR3040 has a slide switch with three positions:
| BUTTON | Event |
|---|---|
| Slide switch | BTN_0 and BTN_1 |
The three postitions are labeld with “3G/4G”, “WISP” and “AP”.
Sample script: https://forum.openwrt.org/viewtopic.php?pid=189097#p189097
mkdir -p /etc/hotplug.d/button
vi /etc/hotplug.d/button/10-slider
#!/bin/sh sleep 1 logger "log: $BUTTON -- $ACTION" if [ $ACTION == "released" ] ; then if [ $BUTTON == "BTN_1" ] ; then logger "Slider WISP" #some actions here elif [ $BUTTON == "BTN_0" ] && grep -qe "sw1.*in lo" /sys/kernel/debug/gpio ; then logger "Slider 3G 4G" #some action here fi elif [ $BUTTON == "BTN_0" ] || [ $BUTTON == "BTN_1" ] ; then if grep -qe "sw1.*in hi" /sys/kernel/debug/gpio ; then if grep -qe "sw2.*in hi" /sys/kernel/debug/gpio ; then logger "Slider AP" #some action here fi fi fi
Bootloader Mods
- you could read about bootloader in general and about Das U-Boot in particular.
U-Boot 1.1.4 modification for routers
Forum member pepe2k made a modification of U-Boot 1.1.4 for Qualcomm Atheros SoCs based devices (the project is still being developed, so new devices and SoCs will be supported in the future). Up to date information, binary images and sources can be found on official GitHub repository.
This modification started from wr703n-uboot-with-web-failsafe project, but supports more devices, all modern web browsers, has a lot of improvements and other modifications (like U-Boot NetConsole, custom commands, overclocking possibilities etc.).
More information:
- Official repository on GitHub: U-Boot 1.1.4 modification for routers
- Discussion about this project on OpenWrt forum
- An article (in Polish) about one of the first version of this project on www.tech-blog.pl
Bootlog
Factory BootLog
U-Boot 1.1.4 (Mar 28 2012 - 17:31:23) AP121 (ar9330) U-boot DRAM: 32 MB led turning on for 1s... id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114 eth0: ag7240_phy_setup eth0 up : eth1: athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0.312 (root@local) (gcc version 4.3.3 (GCC) ) #22 Wed Aug 22 11:18:12 CST 2012 flash_size passed from bootloader = 4 CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29876k/32768k available (1884k kernel code, 2892k reserved, 521k data, 116k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/O]. msgmni has been set to 58 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered protocol family 24 cmdlinepart partition parsing not available set partition boot set partition kernel set partition rootfs set partition config set partition art set partition ÿ Searching for RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs" 0x0000003e0000-0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0x10215 . ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 116k freed init started: BusyBox v1.01 (2012.08.01-03:58+0000) multi-call binary This Board use 2.6.31 xt_time: kernel timezone is -0000 nf_conntrack version 0.5.0 (512 buckets, 5120 max) ip_tables: (C) 2000-2006 Netfilter Core Team insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver, V1.0 PPTP driver version 0.8.3 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory (none) mips #22 Wed Aug 22 11:18:12 CST 2012 (none) (none) login: Now flash open! Now flash open! ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 2 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 1 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 athr_gmac_ring_alloc Allocated 640 at 0x81ea2800 athr_gmac_ring_alloc Allocated 4032 at 0x81d63000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY...mac 0 athr_gmac_ring_alloc Allocated 640 at 0x81ea2400 athr_gmac_ring_alloc Allocated 1536 at 0x81f2f000 athr_gmac_mii_setup: MDC check failed Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY...mac 1 device eth0 entered promiscuous mode Now flash open! ATHR_GMAC: Enet Unit:1 PHY:4 is UP GMii 100Mbps full duplex ATHR_GMAC: done Setting Drop CRC Errors, Pause Frames and Length Error frames br0: port 1(eth0) entering forwarding state nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss) Boostrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created . . . br0: port 2(ath0) entering forwarding state br0: port 2(ath0) entering disabled state TL-MR3040 login:
Resources
- Official TP-Link TL-MR3040 Website
- The latest official firmware is available here
- OEM source code available at: http://www.tp-link.com/resources/gpl/150Router.rar