TP-Link MR3220 Debricking

I bricked my MR3220 router with an OpenWRT firmware upload. I did manage to get it back by soldering a 4 pin header on its pcb to allow connection to its serial port. I used a Sparkfun FTDI Basic Breakout - 3.3V USB to serial port converter . I used minicom in Ubuntu 11.04 to communicate with the MR3220.

Photo showing the FTDI Basic Breakout - 3.3V USB to serial port converter.
MR3220 Debricking Procedure
Do this:
- Power off the router
- Connect the serial cable to the router and the computer
- Connect the Ethernet cable to the router and the computer
- Set the IP address of the NIC in your computer fixed at 192.168.1.27
- Start the tftpd server I used tftpgui and placed the firmware from the TP-Link website renamed to code.bin in the root directory of the tftp server as defined in its settings.
I used info obtained from OpenWRT Wiki and the procedure I used is below
- Start minicom with parameters 8 bit, no parity, one stop bit, 115200 baud, no flow control and no xon-xoff.
- Power the router on
- Boot messages will appear on the minicom terminal
- When the message "autoboot in 1 second .." appears quickly enter password tpl you will have to type quickly. This should interrupt the boot process and you should see the prompt:
ar7100>

To program the new image:
Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Load the new firmware
ar7100> tftpboot 0x81000000 code.bin
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000

To transfer image via Kermit (Serial Port)
You set the router up to receive the file via Minicom using the following commands. Erase the memory
ar7100> erase 0x9f020000 +0x3c0000
Now load the binary file
loadb 0x81000000
Exit Minicom Ctrl A Z X Fire up Kermit:-
set line /dev/ttyUSB0
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send openwrt-ar71xx-generic-tl-mr3220-v1-squashfs-factory.bin
Back to minicom:-
Copy memory bytes into flash memory
ar7100> cp.b 0x81000000 0x9f020000 0x3c0000
Boot kernel image from flash memory location
ar7100> bootm 0x9f020000

Photo of MR3220 showing the four pin header location and pin outs.

That's hopefully it and router should now work.
The router admin webpage is now on 192.168.1.254 , Note: I found that the password was still set to the password I had set when I first got the router and not the manufacturers default password as I expected with a reflash.