Wiki Search

Actions

Donate

Flattr this

Translations

You are here: OpenWrt Wiki » Table of Hardware » TP-Link » TP-Link TL-MR3040
Table of Contents

TP-Link TL-MR3040

A nice portable router powered through included 2000mAh li-ion battery or included USB power adapter for micro-USB socket.

Although it is marketed as a "3G/4G router", the TL-MR3040 does not include a 3G/4G modem. It simply means that the OEM firmware and GUI support a certain range of USB 3G/4G modems, but, OpenWRT supports USB modems too.

The TL-MR11U is hardware similar with very equal connections, which also has an onboard battery. Other TP-Link routers with only similar hardware are the TL-MR3020 and TL-WR703N.

Supported Versions

Version/Model Launch Date OpenWrt Version Supported Model Specific Notes Hardware differences
v1.0 May 2012 Trunk R31845 Confirmed working -
v2.0 January 2013 - ??? added Mode Switch button

Hardware Highlights

CPU Ram Flash Network USB Serial JTag
Atheros AR7240 @ 400MHz 32 MiB 4 MiB 1x 100MBit 1x 2.0 YES NO
  • SoC: Atheros AR9331 rev1
  • 802.11 b/g/n 150Mbps
  • Powered via mini-USB (5V) or Li-ion Battery included (4-5 hours)
  • Only 94g

TL-MR3040 and TL-MR11U differences

Althought MR3040 and MR11U seems similar on the outside, inside isn´t that similar. Here are the diffrences:

  • MR11U is chinese only
  • MR3040(v1.0/v2.0) doesn´t has QSS button
  • USP_POWER GPIO is diferrent
  • Some buttons are in different sides with different looks
  • Also the layers printed on the PCB is different as also some connections
  • MR3040 compared to MR11U photo

Installation (only for v1.0)

So you can either download a daily-built snapshot or build your own from sources.

  • Download the latest Attitude Adjustment RC1 snapshot from here (recommended)
  • Download the lastest trunk snapshot here (risky)

WARNING: Snapshot images are always risky. Check the forum discussion for latest opinions on available images.

Method Using Web GUI (Recommended)

As with most TP-Link Routers this one can be flashed using the TP-Link Webinterface. Connect to the TL-MR3040 router via Ethernet cable at IP address 192.168.0.1, login to the router's web GUI (default login/password: admin / admin), and overwrite the factory firmware by installing the openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin like a regular firmware update.

Wait for the progress bar to finish twice (the device will reset itself in the process), and proceed with basic configuration as with any fresh OpenWRT install.

Manual Flash under U-Boot Serial Console

  • To install OpenWrt from the U-Boot console, you need to install a TFTP server on your computer.
  • By default the server is set to 192.168.0.100, you can check detail by 'printenv'
  • The serial layout is p1: →serial.console
  • Setup serial console 115200 8n1, for example: screen /dev/ttyUSB0 115200 ixoff

Power up the TL-MR3040, after a 1-2 seconds U-Boot announces "Autobooting in 1 seconds", when displaying this enter tpl immediately. 

Autobooting in 1 seconds
[type tpl here]

You will get a U-Boot-console, it shows as hornet>, and you must enter the following commands: 

hornet> tftpboot 0x81000000 openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin
Using eth0 device
TFTP from server 192.168.0.100; our IP address is 192.168.0.1
Filename 'openwrt-ar71xx-generic-tl-mr3040-v1-squashfs-factory.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
hornet> erase 0x9f020000 +0x3c0000

First 0x2 last 0x3d sector size 0x10000                                                                                                        61
Erased 60 sectors
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
Copy to Flash... write addr: 9f020000

done
hornet> bootm 9f020000

Upgrading OpenWrt

→generic.sysupgrade

Failsafe Mode

  1. Switch on the router
  2. Wait almost 5 sec
  3. Press the "Reset" for ~3sec
  4. The device is now in Failsafe-Mode
  5. You may access it by using telnet 192.168.1.1/24 or serial

The LEDs won't flash in Failsafe Mode

Restoring Original Firmware

hornet> tftpboot 0x81000000 mr3040v1_en_3_12_11_up(120328).bin
...
hornet> erase 0x9f020000 +0x3c0000
...
hornet> cp.b 0x81000000 0x9f020000 0x3c0000
...
hornet> bootm 9f020000

Basic Configuration

Since this part is identical to generic devices, see Basic configuration.

Original Flash Layout

Please read the article Flash Layout for a better understanding. It contains a couple of explanations. Then let's have a view at flash layout of this particular device:

TP-Link MR3040 Flash Layout stock firmware
Layer0 spi0.0: 4096KiB
Layer1 mtd0 mtd1 mtd2 mtd3 mtd4
Size in KiB 128KiB 1024KiB 2816 KiB 64KiB 64KiB
Name u-boot kernel rootfs config art
mountpoint none none / none none
filesystem none none SquashFS none none

ART = Atheros Radio Test - it contains RF calibration data for the wifi. If it is missing or corrupt, wireless won't come up anymore.

Hardware

Opening the device

Remove back cover, remove battery. Unscrew two screws, open case in the corner next to the ethernet port (there is a small triangle here). Push a screwdriver into the hole next to the battery (closest to ethernet port) and pull cover until it snaps open. Next push in the screwdriver in the next corner next to the battery.

Info

IC Datasheet
Processor AR7240 atheros.ar7240.pdf
Flash ROM Spansion S25FL032P http://www.spansion.com/Support/Datasheets/S25FL032P_00.pdf
SDRAM Zentel A3S56D40FTP http://www.kean.com.au/oshw/WR703N/teardown/Zentel%20A3S56D40FTP%20DDR%20256Mb%20SDRAM.pdf
Chipset (Wi-Fi controller) AR9331 http://see.sl088.com/w/images/6/69/AR9331.pdf

Serial Console

Pinout
1 2 3 4
TX RX GND VCC P1

Pin 1 is clearly marked on the board.

The right settings for accessing the serial console are as follows:

Bits per second: 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None

U-Boot Bootloader Console

The password to get the U-Boot prompt is tpl. You must type it quickly while the serial console is displaying: 

[...]
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
[type tpl here]

U-Boot accepts several commands. Type help to display the list of available commands.

Linux Console

Once the original firmware has booted up completely, you can press return to activate the Linux login prompt. 

TL-MR3040 login: root
password: 5up

Photos

Bigger front image, for better view.

Version 1.1 Main board

Version 1.1 back

mr3040_battery.jpg

TL-MR3040 Reverse Engineering

The TL-MR3040 has been teared down by Jarocks, wich was very useful to check the pinout. The investigation was complete thanks to doiga, also check the forum

GPIOs

→ port.GPIO

The AR933x platform provides 28 GPIOs, some of them are used by the router for status LEDs, buttons and other stuff.

The TL-MR3040 provides 3 free GPIOs.

The table below shows the results of the investigation, based on the AR9331 datasheet:

GPIO Available AR9331 Pin Description
0 R8 A78 Must have 0 value during bootstrap*
1 R11 A77 Must have 1 value during bootstrap
2 SPI_CS_0 B49 Used by SPI Flash
3 SPI_CLK B51 Used by SPI Flash
4 SPI_MOSI B50 Used by SPI Flash
5 SPI_MISO A57 Used by SPI Flash
6 NC
7 NC
8 NC
9 SIN B68 Serial INPUT (Rx)
10 SOUT A79 Serial OUTPUT (Tx)
11 RESET SW B48 Soft Reset Switch
12 R84 A56 Must have 0 value during bootstrap
13 R12 B66 Must have 1 value during bootstrap
14 R9 A76 unused Pulled to ground
15 R10 B65 unused Pulled to ground
16 R13 A75 Must have 0 value during bootstrap
17 LED2 B64 LAN LED
18 USB_POWER A28 Control USB Host Power
19 NC
20 R15 A27 unused Pulled to ground
21 NC
22 NC
23 NC
24 NC
26 LED3 A51 Wireless LAN LED
27 LED1 B44 3G LED
28 N/A A74 Must have 0 value during bootstrap

*GPIO_0 can be floating (i.e. resistors removed) during boostrap and the router still boots! TESTED!!!

To make the GPIOs available via sysfs, the required ones have to be exported to userspace, as it is explained on a page of the Squidge-Project.

LEDs

How to configure LEDs in general, see the LED section in the system.

The TL-MR3040 has 5 LEDs:

LED name LED color LED print Internal name Trigger
Power (2 LEDs) Green/Red Power/Charge symbol N/A (fixed supply) N/A
LAN Green LAN symbol tp-link:green:lan netdev:eth0
Wireless LAN Green WLAN symbol tp-link:green:wlan phy0tpt
3G Green Internet symbol tp-link:green:3g USB:1-1

USB Port

Like other devices using the ar933x platform, this model suffers from problems when directly connecting USB 1.1 devices (specified for low speed or full speed; normally serial adapters). These problems can be circumvented by using a (passive) hub between the router and the USB devices. More information in the forum.

This problem can also be circumvented by using an external powered USB HUB 2.0 HIGH-SPEED.

Bootlog

Factory BootLog

U-Boot 1.1.4 (Mar 28 2012 - 17:31:23) AP121 (ar9330) U-boot DRAM: 32 MB led turning on for 1s... id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114 eth0: ag7240_phy_setup eth0 up : eth1: athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done ag7240_phy_setup eth1 up eth0, eth1 Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0.312 (root@local) (gcc version 4.3.3 (GCC) ) #22 Wed Aug 22 11:18:12 CST 2012 flash_size passed from bootloader = 4 CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816(rootfs),64k(config),64k(ART) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 29876k/32768k available (1884k kernel code, 2892k reserved, 521k data, 116k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 bio: create slab at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher NTFS driver 2.1.29 [Flags: R/O]. msgmni has been set to 58 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled PPP generic driver version 2.4.2 NET: Registered protocol family 24 cmdlinepart partition parsing not available set partition boot set partition kernel set partition rootfs set partition config set partition art set partition ÿ Searching for RedBoot partition table 5 RedBoot partitions found on MTD device ar7240-nor0 Creating 5 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs" 0x0000003e0000-0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0x10215 . ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Port Status 1c000004 ar7240-ehci ar7240-ehci.0: ATH EHCI ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000 ehci_reset Intialize USB CONTROLLER in host mode: 3 ehci_reset Port Status 1c000000 ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 116k freed init started: BusyBox v1.01 (2012.08.01-03:58+0000) multi-call binary This Board use 2.6.31 xt_time: kernel timezone is -0000 nf_conntrack version 0.5.0 (512 buckets, 5120 max) ip_tables: (C) 2000-2006 Netfilter Core Team insmod: cannot open module `/lib/modules/2.6.31/kernel/iptable_raw.ko': No such file or directory insmod: cannot open module `/lib/modules/2.6.31/kernel/flashid.ko': No such file or directory PPPoL2TP kernel driver, V1.0 PPTP driver version 0.8.3 insmod: cannot open module `/lib/modules/2.6.31/kernel/harmony.ko': No such file or directory (none) mips #22 Wed Aug 22 11:18:12 CST 2012 (none) (none) login: Now flash open! Now flash open! ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 2 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 1 ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 athr_gmac_ring_alloc Allocated 640 at 0x81ea2800 athr_gmac_ring_alloc Allocated 4032 at 0x81d63000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY...mac 0 athr_gmac_ring_alloc Allocated 640 at 0x81ea2400 athr_gmac_ring_alloc Allocated 1536 at 0x81f2f000 athr_gmac_mii_setup: MDC check failed Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS26: resetting s26 ATHRS26: s26 reset done Setting PHY...mac 1 device eth0 entered promiscuous mode Now flash open! ATHR_GMAC: Enet Unit:1 PHY:4 is UP GMii 100Mbps full duplex ATHR_GMAC: done Setting Drop CRC Errors, Pause Frames and Length Error frames br0: port 1(eth0) entering forwarding state nf_conntrack_rtsp v0.6.21 loading nf_nat_rtsp v0.6.21 loading asf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U5.508 (Atheros/multi-bss) Boostrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash ath_get_caps[4735] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[4710] tx chainmask mismatch actual 1 sc_chainmak 0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x80d202c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. VAP device ath0 created . . . br0: port 2(ath0) entering forwarding state br0: port 2(ath0) entering disabled state TL-MR3040 login:


Resources

  • Official TP-Link TL-MR3040 Website
  • The latest official firmware is available here
  • Althought TL-MR3020 and TL-WR703N are ONLY hardware similar, most probably some modifications work, like External Antenna Hack!!!

Tags

, , , , , , , , , , , , , ,

Back to top

toh/tp-link/tl-mr3040.txt · Last modified: 2013/03/10 12:32 by doiga