TP-Link TL-MR3020

Links of Interest

 * https://forum.openwrt.org/viewtopic.php?pid=154644
 * TP-Link MR3020 support - DD-WRT forum

JTAG Recovery
AR9331 do not provide EJTAG interface in the way, we can usually find it on other chips:
 * First of all, jtag pins are multiplexed with GPIOs. And it need pull up for GPIO11 to bootstrap debug interface. On this board, press SW2 switch on power on. This switch is connected to GPIO11.
 * Second problem is U-Boot which will disable EJTAG, even if it was enabled by GPIO11 bootstrap. To workaround it, you can add jumper between CS pin on flash and CPU.
 * and last problem is that TP-Link usually do not provide test points or pins for jtag.

OpenOCD
This sequence will be needed to initiate PLL and RAM: #pll initialization mww 0xb8050008 0x00018004 mww 0xb8050004 0x00000352 mww 0xb8050000 0x40818000 mww 0xb8050010 0x001003e8 mww 0xb8050000 0x00818000 mww 0xb8050008 0x00008000 sleep 1 # Setup DDR1 config and flash mapping mww 0xb8000000 0x7fbc8cd0 mww 0xb8000004 0x9dd0e6a8

mww 0xb8000010 0x8 mww 0xb8000008 0x133 mww 0xb8000010 0x1 mww 0xb800000c 0x2 mww 0xb8000010 0x2 mww 0xb8000010 0x8 mww 0xb8000008 0x33 mww 0xb8000010 0x1 mww 0xb8000014 0x4186 mww 0xb800001c 0x8 mww 0xb8000020 0x9 mww 0xb8000018 0xff

#UART mww 0xb8020004 0x4388 mww 0xb8020008 0xc2000

#GPIO mww 0xb8040028 0x48002

Serial Recovery
Make sure your computer has a static IP set to 192.168.1.2. If you wish to use something else, change the serverip line below. tpl type this as soon as you plug in the router and see output setenv ipaddr 192.168.1.1 setenv serverip 192.168.1.2 printenv only to confirm settings tftp 0x80800000 firmware.bin tftp server needed eg. TFTPD32/64 for Windows verify 0x3c0000 at the end of TFTP session and change if needed erase 0x9f020000 +0x3c0000 cp.b 0x80000000 0x9f020000 0x3c0000 bootm 0x9f020000 I've only gotten the factory-to-ddwrt.bin file to flash successfully like this. The stock firmware fails to boot when flashed like this. Of course you can always flash to dd-wrt and then use a special revert firmware to go back to the stock.