Even though it is marketed as a "3G travel router", the TL-MR3020 does not include a 3G modem. It simply means that the OEM firmware and GUI support a certain range of USB 3G modems. OpenWRT supports USB 3G modems, too. The router is powered through a mini-USB socket stub (5V) and comes with a USB power adapter.

The router is very similar to the TL-WR703N.

• SoC: Atheros AR9330 rev 1
• 802.11 b/g/n 150Mbps
• Powered via mini-USB (5V)
• Tiny form factor
  • 5.7cm x 5.7cm PCB
  • 6.7cm x 7.4cm x 2.2cm case

Input voltage: the router will function correctly when powered with voltage as low as 2.6V (determined experimentally) instead of 5V. Thus it can be powered directly from Li-Ion batteries (3.7V) without the need for an external adapter to 5V.

Currently the TL-MR3020 is not supported in any stable OpenWrt version, but it is supported in latest snaphots.

So you can either download a daily-built snapshot or build your own from sources.

• Download the latest Attitude Adjustment RC1 snapshot from here (recommended)
• Download the lastest trunk snapshot here (risky)

WARNING: Snapshot images are always risky. Check the forum discussion for latest opinions on available images.

Connect to the TL-MR3020 router via Ethernet cable at IP address 192.168.0.254, log in to the router's web GUI (default login/password: admin / admin) and overwrite the factory firmware by installing the openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin firmware image like a regular firmware update.

Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed with basic configuration as with any fresh OpenWRT install.

Web GUI upload has been confirmed to work with v1.0, v1.4, v1.6 and v1.7 hardware and requires no serial access unless something goes wrong.

See forum if you encounter problems.

To install OpenWrt from the U-Boot console, you need to install a TFTP server on your computer (tftp-hpa is recommended).

Then download OpenWrt factory image to /srv/tftp (for example), and execute the TFTP server by typing tftpd -l -s /srv/tftp.

Connect the TL-MR3020 using a serial console and power up the TL-MR3020.

After a 1-2 seconds it shows Autobooting in 1 seconds, when displaying this enter tpl immediately.

Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands:

hornet> setenv ipaddr <device-ip, eg. 192.168.1.111>
hornet> setenv serverip <server-ip, eg. 192.168.1.100>
hornet> tftpboot 0x80000000 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin'.
Load address: 0x80000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000                                                                                                        61
Erased 60 sectors
hornet> cp.b 0x80000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000

done
hornet> bootm 9f020000

Flashing hundreds of devices using the web interface can be a real pain. You can use this shell script to automate it:

#!/bin/bash

# Pass the firmware file to be flashed as the first parameter.
#
# The second curl call will time out, but it's expected. Once the
# script exits you can unplug the ethernet cable and proceed to the
# next router, but KEEP each router ON POWER until the new image is
# fully written! When flashing is done the router automatically
# reboots (as shown by all the leds flashing once).

curl \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.0.254/userRpm/SoftwareUpgradeRpm.htm' \
  --form "Filename=@$1" -F 'Upgrade=Upgrade' \
  http://192.168.0.254/incoming/Firmware.htm > /dev/null

sleep 1

curl \
  --max-time 2 \
  --user admin:admin \
  --user-agent 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0' \
  --referer 'http://192.168.0.254/incoming/Firmware.htm' \
  http://192.168.0.254/userRpm/FirmwareUpdateTemp.htm >  /dev/null

• Set your computer's IP to 192.168.1.2, subnet 255.255.255.0
• Connect the TL-MR3020 to your computer via ethernet
• Power on the TL-MR3020
• When the WPS Button starts to blink , push it until it blinks faster
• The device is now in Failsafe-Mode
• You may access it by using telnet 192.168.1.1

Restoring the original firmware follows the usual procedure:

• Get original firmware image into /tmp
• Make sure it's in the correct format
• Flash with mtd
• Factory reset

WARNING: The following steps were tested successfully on an MR-3020 V1.4. Make sure that the firmware link used in the instructions below matches your hardware revision by following the firmware link in the link section below.

First, set the mode switch to WISP. Without it, you might have trouble connecting after the reboot. Connect via ssh/telnet/serial and use the following commands:

# opkg update && opkg install unzip
# cd /tmp
# wget http://www.tp-link.com/Resources/software/TL-MR3020_V1_120320.zip
# unzip TL-MR3020*.zip
# mtd -r write mr3020*up*.bin firmware

After a couple of seconds, the router reboots automatically. Reconnect, open http://192.168.0.254, log in with admin / admin, and do a factory reset with System Tools / Factory Defaults.

Since this part is identical to the one recommended for generic devices, see Basic configuration.

Please read the article Flash Layout for a better understanding. It contains a couple of explanations. Then let's have a quick view at flash layout of this particular device:

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.

The case consists of two parts: a white base and a gray lid. The lid has two snap hinges, one right above the mini USB connector and one on the opposite side about 10 mm left of the "TP-LINK" logo. The lid is additionally glued in place on the underside on all four sides. You can try to pry it open with a thin but very stable blade tool. Start above the ethernet port where the case is not glued, and work your way around the glued corner towards the "3G USB" port (no glue there) until you reach the logo side. You should now be able to peek inside the case on the lose corner.

Next proceed along to the LED side, but beware of the fragile light conductors running straight down beneath the clear plastic. They easily bend or break when you push-in your tool too far. Once three sides are open, you can steadily lift the lid until the remaining side breaks lose and neatly frees the second hinge in the process. If you work carefully and manage not to break either one of the two hinges, the gray lid should snap neatly back into place after some manual cleaning with a cutter knife.

Pin 1 is clearly marked on the board.

To get a reliable serial connection, you might have to connect a 10k pullup resistor between TX and VCC. This is because the TX pin is connected to a voltage divider (2x5.6k) and a capacitor is put between the real pin and the TX connector. Some serial adaptors might work without the pullup resistor (confirmed for one ST3232-based adaptor), but others definitely require it (confirmed for a FTDI FT232RL-based model).

If you need a serial adaptor, you can build a serial hack adapter (DKU-5, CA-42). Relatively cheap, off-the-shelf and known-to-work alternatives would be SparkFun's FTDI Basic Breakout 3.3V and FTDI Serial Cable 3.3V.

The right settings for accessing the serial console are as follows:

Bits per second: 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

If you are using a Linux or Mac system, the easiest way to connect to the serial console would be the screen command. It comes pre-installed on OS X, but must usually be installed on Linux systems. When installed, just type in a terminal:

screen /dev/[device name] 115200

where [device name] is the name of your serial adaptor, usually tty.usbserial* on Mac and ttyUSB* on Linux. To quit screen, press CTRL-a, followed by CTRL-k, followed by y.

The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying:

[...]
ag7240_phy_setup 
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

U-Boot accepts several commands. Type help to display the list of available commands.

hornet> help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase FLASH memory
help    - print online help
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset   - Perform RESET of the CPU
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version

Once the original firmware has booted up completely, you can press return to activate the Linux login prompt.

The password to get a root Shell access is 5up:

TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none)
TL-MR3020 login: root
password: 5up

→ port.GPIO The AR933x platform provides 30 GPIOs. Some of them are used by the router for status LEDs, buttons and other stuff. The table below shows the results of some investigation:

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project. Kernel modules occupying that resource need to be removed before (e.g. "leds-gpio" and "gpio-buttons"). In output-mode, voltage levels of the GPIOs were measured against GND, after the value 1 or 0 had been written to /sys/class/gpio/gpioX/value. In input-mode, the value of the file /sys/class/gpio/gpioX/value was read when the GPIO was floating (initial state), pulled to GND or pulled to Vcc.

The sliding switch has the following truth table:

How to configure LEDs in general, see the LED section in the system.

The TL-MR3020 has 5 LEDs:

→ hardware.buttons The TP-Link TL-MR3020 has one button and one sliding switch with three positions:

The WPS button is located at the top (illuminated by the WPS LED) and can be easily pressed with a finger. The sliding switch is located at the side and has three positions: 3G, WISP, AP.

If you want to add an external antenna connector or would like to know more about the MR3020 power consumption in different op-states you can find more info Apollo-NG MR3020 External Antenna Hack

If you want to add I2C bus to your MR3020, you can use GPIO 7 and 29. Remove R15 and R17, then add pullup between 3.3v and gpio pin.

Next step, add this line

i2c-gpio-custom bus0=0,7,29

and load i2c-gpio-custom

You can find more info in french here http://www.equinoxefr.org/post/2012/11/12/mr3020-et-i2c-avec-les-gpio/

You can embedded usb hub to add more peripheral to your best router.

I hack a 3$ STOREX usb hub, a 2$ µSD card reader and a 10$ webcam to build a robot with my MR3020.

More info in french on http://www.equinoxefr.org/post/2012/11/05/projet-de-robot-wifi-torture-dun-routeur-tplink-mr3020/

The USB port on the TL-MR3020 is not compatible with USB1 devices (aka full speed) and only works properly with USB2 (aka high speed) devices. You can however plug a USB-Serial adapter as long as you plug that through a <$10 USB2. While you're at it, use another USB port to plug in a USB key and write data there (like serial console logs) so as not to wear out the built in flash.

See this page for more tips and how to create a serial console server out of your TL-MR3020: http://marc.merlins.org/perso/linux/post_2012-12-05_Serial-Console-With-WR703N.html

U-Boot 1.1.4 (Aug 17 2011 - 09:25:09)

AP121-2MB (ar9330) U-boot

DRAM:  32 MB
led turning on for 1s...
id read 0x100000ff
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting AR9330(Hornet)...
Linux version 2.6.31--LSDK-9.2.0.312 (root@bogon) (gcc version 4.3.3 (GCC) ) #185 Fri Oct 21 16:26:50 CST 2011
flash_size passed from bootloader = 4
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29864k/32768k available (1889k kernel code, 2904k reserved, 524k data, 116k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0


Whoops! This kernel is for product mr3020 v1.0!

bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
msgmni has been set to 58
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
cmdlinepart partition parsing not available
set partition boot
set partition kernel
set partition rootfs
set partition config
set partition art
set partition ÿ
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7240-nor0
Creating 5 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000120000 : "kernel"
0x000000120000-0x0000003e0000 : "rootfs"
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "art"
->Oops: flash id 0x10215 .
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 116k freed
init started:  BusyBox v1.01 (2011.04.01-07:49+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (512 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory

 (none) mips #185 Now flash open!
Fri Oct 21 16:26:50 CST 2011 (none)
(none) login: Now flash open!
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: Mac address for unit 1:bf1f0006
ATHR_GMAC: 6e:09:80:e4:67:1b
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   4D83
ATHR_GMAC: Mac address for unit 0:bf1f0000
ATHR_GMAC: 12:03:cb:60:38:f7
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   4403
athr_gmac_ring_alloc Allocated 640 at 0x81e79800
athr_gmac_ring_alloc Allocated 4032 at 0x81d63000
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...mac 0
athr_gmac_ring_alloc Allocated 640 at 0x81e79400
athr_gmac_ring_alloc Allocated 1536 at 0x81f22000
athr_gmac_mii_setup: MDC check failed
Setting Drop CRC Errors, Pause Frames and Length Error frames
ATHRS26: resetting s26
ATHRS26: s26 reset done
Setting PHY...mac 1
device eth0 entered promiscuous mode
Now flash open!
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss)
Boostrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created

 DES SSID SET=TP-LINK_POCKET_3020_3ABB7A
ieee80211_scan_unregister_event_handler: Failed to unregister evhandler=c0a048a0 arg=81e9e2c0
wlan_vap_delete : enter. vaphandle=0x81e9c000
wlan_vap_delete : exit. vaphandle=0x81e9c000
wlan_vap_create : enter. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x80c042c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created

 DES SSID SET=TP-LINK_POCKET_3020_3ABB7A
 ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1
WARNING: Fragmentation with HT mode NOT ALLOWED!!
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
 ieee80211_ioctl_siwmode: imr.ifm_active=1442432, new mode=3, valid=1
br0: port 2(ath0) entering disabled state

 DES SSID SET=TP-LINK_POCKET_3020_3ABB7A
br0: port 2(ath0) entering forwarding state
gpio_tricolor_led_write 699
green_led_onoff = 1

 TL-MR3020 mips #185 Fri Oct 21 16:26:50 CST 2011 (none)
TL-MR3020 login:

• dmesg TP-Link TL-MR3020

• Product web-page : TL-MR3020
• The latest official firmware is available here
• The official GPL code is available here.
• A backup of the whole original SPI flash content is available from here.
• Taschenrouter als IPv6-Verteiler (auf Deutsch)
• Interesting webpage with more data about power consumption and so on

TP-Link TL-MR3020 Support

A custom image with ipv6 support: radvd, wide-dhcpv6, 3g stick support, made for RCS-RDS Fiberlink dual stack PPPoE service, but should be okay for static wan settings on other ISPs: http://www.ip6.ro/firmware/mr3020/