Jump to: navigation, search

Serial Port Access and Firmware Recovery for TL MR3020

Author: Terry Gillett

Introduction

The following describes how to get access to the serial port on the MR3020 router and how to recover the firmware on the device in the event that the device is not accessible by normal means.

The process requires a PC running a serial port, a level shifter adapter, a serial terminal program, and a tftp server program.

Generic serial adapters and USB Serial Adapters may also be used by accessing the appropriate pins for TX, RX and Gnd.

Preparation

Set up Serial Port connections on the MR3020

For information on setting up the serial port connections, refer to:

 http://wiki.openwrt.org/toh/tp-link/tl-mr3020#opening.the.case
 http://wiki.openwrt.org/toh/tp-link/tl-mr3020#internal.pictures
 http://wiki.openwrt.org/toh/tp-link/tl-mr3020#serial.console
 http://wiki.openwrt.org/toh/tp-link/tl-mr3020#gpio.pinout

NOTE: Ensure that the MR3020 device is powered OFF when fitting and removing the Serial Adaptor to avoid damage.

Set Up Serial Terminal Program

To use the Serial interface on the MR3020, a Serial Terminal program is required on your PC.

Install a serial terminal program, e.g. GtkTerm for a Ubuntu PC. Set the configuration to be

 - 115kbps
 - no parity
 - 8 bits
 - 1 stop bit
 - No Flow Control

The serial port setting will typically be /dev/ttyS0 for the first serial port on the PC.

For a USB Serial Adapter the serial port setting will be typically /dev/ttyUSB0 It is necessary to connect the USB Serial adapter for the port to appear and to be able to configure the settings.

Note: It may be necessary to run the terminal with root privileges if you have a problem with permission to configure the serial port. To do this, open a terminal and enter the command:

 $ sudo gtkterm

Using a serial cable, connect the PC serial port to the serial port adapter on the MR3020. A 'null modem' may be required depending on the particular serial adapter. For a USB Serial adapter, use a suitable USB cable.

Using U-boot

Connect the serial port and power up the MR3020.

You should see the U-boot start up sequence, which includes a brief pause to allow you to halt the normal startup process.

After a 1-2 seconds it shows 'Autobooting in 1 seconds'

Enter the characters "tpl" immediately.

There is a very short window of time to do this, so you may have to try several times.

If successful, you will see the prompt "hornet>".

To see a list of available commands, enter the command.

 hornet> help

If you do not interrupt the startup process, the normal boot sequence will continue until eventually you will get to a prompt to press 'Enter' to activate a terminal session if the firmware is operating correctly.

Pressing the Enter key at this point will take to to the system command line as the 'root' user.

Note that after this last prompt appears on screen, further output from the device will continue to appear on screen, and the prompt will scroll off screen. You may press Enter at any time to go to the command line.

Set up the TFTP Server

This section describes the installation and configuration of the tftpd-hpa software on a Ubuntu workstation.

(For a Windows workstation see e.g. http://tftpd32.jounin.net/)


A. Install tftpd-hpa

 $ sudo apt-get install tftpd-hpa


B. Configure tftpd-hpa for Daemon Operation

Configure the newly installed TFTP to run as a daemon by editing the file: /etc/default/tftpd-hpa

 $ gksudo gedit /etc/default/tftpd-hpa

Add the line:

 RUN_DAEMON="yes"


C. Set the TFTP root directory

This config file also defines where your TFTP server is serving from ie the tftp root directory.

The default location is /var/lib/tftpboot but may be changed in this file if desired.


D. Start the TFTP service Start the newly configured TFTP service as follows:

For Ubuntu 10.04 and later, use:

 $ sudo service tftpd-hpa start

For earlier versions of Ubuntu use:

 $ sudo /etc/init.d/tftpd-hpa start


E. Test the TFTP server

Save a suitable small file 'myfile' in the TFTP Server root directory.

Use the 'tftp' command in a terminal session to copy the file to a working directory

 $ tftp
 tftp> ?  (for a list of commands)
 tftp> connect localhost  OR   connect <IP_address_of_PC>
 tftp> get myfile

You should see the file received with details of size and time.

Flashing Firmware via Serial Port and TFTP

Firmware can be loaded on to the device using the serial port and the U-boot firmware on the device to set up a TFTP transfer via the Ethernet port.

This is useful to replace a firmware that can not be recovered by other means such as the OpenWrt Failsafe mechanism.

The U-boot firmware provides a tftp client. To flash the device with new firmware, you must have a tftp server set up on your PC as described above, and the necessary files available to the tftp server to send to the device.

To set up a tftp server, see the section above on installing the TFTP Server software.

By default, the MR3020 bootloader firmware is configured with the tftp client on 192.168.1.111, and expects to find the tftp server on 192.168.1.100

These values can be viewed and changed with the U-boot commands 'printenv' and 'setenv'.


A. Set up the PC with a static IP of 192.168.1.100 on the Ethernet port and connect it to the WAN/LAN port of the MR3020 with an Ethernet cable.

Ensure that the TFTP server is correctly configured and running.


B. Download a suitable 'factory' firmware file from OpenWrt downloads page such as

 http://downloads.openwrt.org/barrier_breaker/14.07/

The required file is typically:

 openwrt-ar71xx-generic-tl-mr3020-v1-squashfs-factory.bin

Copy the 'factory' file in to the TFTP Server root directory.

Copy/rename this file to something simple like 'mr3020-factory.bin' to match the tftp commands to be used in Step E (see below).


C. Start Serial Console

Connect the MP-02 serial port to the PC serial port.

Start up the Serial Terminal program and ensure it is correctly configured (115k,8,N,1).

Power up the MR3020 and interrupt the boot sequence to get to the U-boot prompt (Type "tpl" at the 'Autobooting in 1 sec' prompt'

Check the IP settings for the MR3020 with the command:

 hornet> printenv
 
 ipaddr=192.168.1.111
 serverip=192.168.1.100

If necessary, you can change the IP addresses using the 'setenv' command.

D. Restart the tftp server to ensure it is correctly associated with the running network:

For Ubuntu 10.04 and later, use:

$ sudo service tftpd-hpa restart

For earlier versions of Ubuntu use:

$ sudo /etc/init.d/tftpd-hpa restart


E. On the serial console of U-boot, enter these commands *exactly* to transfer the file and write it into memory:

 hornet> tftpboot  0x80000000  mr3020-factory.bin
 hornet> erase  0x9f020000  +0x3c0000
 hornet> cp.b  0x80000000  0x9f020000  0x3c0000

You can copy these commands (starting at tftp ...) and paste them into the terminal window using the GtkTerm menu item Edit/Paste.


F. Once this is finished, boot from Uboot:

 hornet> bootm  9f020000

You should see the full boot sequence. Press Enter at the end of the sequence to enter terminal mode.


G. The MR3020 device should now be running normally. Power down the device and remove the serial port adaptor.


Typical UBoot session:

 hornet> setenv ipaddr 192.168.1.111
 
 hornet> setenv serverip 192.168.1.100
 
 hornet> tftpboot  0x80000000  mr3020-factory.bin
 
 eth1 link down
 dup 1 speed 100
 Using eth0 device
 TFTP from server 192.168.1.100; our IP address is 192.168.1.111
 Filename 'mr3020-factory.bin'.
 Load address: 0x80000000
 Loading: #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        #################################################################
        ######################################################
 done
 Bytes transferred = 3932160 (3c0000 hex)
 hornet> erase 0x9f020000 +0x3c0000
 First 0x2 last 0x3d sector size 0x10000                                                                                                        61
 Erased 60 sectors
 
 hornet> cp.b 0x80000000 0x9f020000 0x3c0000
 Copy to Flash... write addr: 9f020000
 
 done
 
 hornet> bootm 9f020000