OpenWrt Forum Archive

Topic: (TL-WR703n / GPIO / Misc) AR9331 pinouts?

The content of this topic has been archived between 7 Oct 2014 and 7 May 2018. Unfortunately there are posts – most likely complete pages – missing.

Okay, you guys asked for it. I removed the SoC - will that help identify more GPIO?
http://nut-bolt.nl/assets/wr703n-soc-removed.jpg

A small update: I have removed resistors and soldered wires to GPIOs 0, 7, 9, 10, 14, 29. I have wired access to ground, 3.3 and 5 volts. And the unit still boots and is accessible. I did try and solder to GPIO15, but managed to rip the whole trace off the board!
To get this far, I am indebted to so many of you and other on the net. My crib sheet photos (shamelessly stolen and in one case edited - sorry to the originators) are here: http://imgur.com/a/vlVYr
Next up is connecting all the wires to a header and trying some GPIO access.

imperfect wrote:

If someone else wants to try, here is my notes:
1) GPIOs 1 and 2 are connected to the group of resistances at the bottom of the board (R2 R14). Not sure if they are usable, they can be nesassary for the DRAM initialization
2) The contact group near R57 R60 and R62 is SPI. 10.1KOhm pull-ups are used for SPI lines, so need to check if i2c will work with the same pull-up.
3) GPIO6 is connected to the voltage regulator U6 (R110, R107). Not sure about it's functions, but changing it's state doesn't affect USB functionality. Maybe it's an overcurrent interrupt?

imperfect, can you elaborate on the SPI contacts?

love your work btw.

robthebrew wrote:

imperfect, can you elaborate on the SPI contacts?

love your work btw.

IMHO the flash is connected through SPI (MOSI,MISO,CLK,CS0). CS1 is shared with GPIO_0.
Should be all you need to connect another SPI device.

I'll worry about SPI later. Here are short notes on what I have so far tested:

Testing output control via LEDs:
9,10 always dimly lit (from boot on): need to check voltage on these. I think I've seen there might be a problem controlling these without disabling the serial interface.
7 is lit at boot (all others bar  the 9,10 are unlit), but thereafter can be controlled.
0,14,29 behave as expected.

Update:

configured as inputs and supplying 3v3 via a 10K resistor shows that 0,7,9,14,29 are working. 10 is high irrespective of voltage applied.

Note though, that I haven't disabled the serial port, so this may well be the source of the issues with 9 and 10.

(Last edited by robthebrew on 25 Jul 2012, 08:57)

hey how to find gpio pins on a router with a multimeter i want to find gpio pins another tplink router i have played gpioctl and found i could control over 4 gpio pins in my router now it is time to find then how should i use the test probes from the multimeter

Others will know more than me, but:
1. find ground (like that on the USB port)
2. look for traces coming from the SoC via just one resistor (10K?) and linked to ground: these are most likely unused GPIOs
3. put your multimeter between gnd and the resister (try both sides)
4. try this until you get a reading (change):
(this is for GPIO0)
echo 0 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio0/direction
echo 0 > /sys/devices/virtual/gpio/gpio0/value
echo 1 > /sys/devices/virtual/gpio/gpio0/value

Further update: I now have w1 interface on any of the fully functional pins (ie not 9,10 which I am leaving a serial access in case I screw up).
I have r32878 installed so had to --force-depends to get the w1 kmods installed, but I am now reading temps via a dallas sensor.
I followed this to get running:
http://www.instructables.com/files/orig … AGKOCR.txt

I am not sure, but it looks like that J1 (bottom edge of the PCB in the above picture) is a shunt directly on the antenna path, or am I wrong?

If this is the case, this may be a more convenient place (by removing it!) to solder an external SMA cable like this:
https://forum.openwrt.org/viewtopic.php … 57#p152457

NutBolt wrote:

Okay, you guys asked for it. I removed the SoC - will that help identify more GPIO?

I don't know if this will help to find more GPIOs, but thank you!

What would be very interesting would be to unsolder all the big chips (Flash, SDRAM, crystal, transformer, maybe connectors) and take some hi-res pictures, so people can work on reverse-engineering the full schematic: it really looks like the board is only 2-layer (maybe more, but not very complex)...

Squonk wrote:

I am not sure, but it looks like that J1 (bottom edge of the PCB in the above picture) is a shunt directly on the antenna path, or am I wrong?

If this is the case, this may be a more convenient place (by removing it!) to solder an external SMA cable like this:
https://forum.openwrt.org/viewtopic.php … 57#p152457

That is possible. How best to check? Measure continuity between the shunt and the visible antenna underneath?
Presumably you would have to find a solderable gnd on the top side for the shield?

robthebrew wrote:

That is possible. How best to check? Measure continuity between the shunt and the visible antenna underneath?
Presumably you would have to find a solderable gnd on the top side for the shield?

The round pad just above it looks like a good ground to me! I'll try to check!

Hi,

This post is an attempt to understand the purpose of each and every component on the TP-Link TL-WR703N Wireless router PCB, Rev. 1:1, as pictured in the OpenWRT Wiki page related to this product:

http://wiki.openwrt.org/_media/toh/tp-link/tl-wr703n_top.jpg?w=600http://wiki.openwrt.org/_media/toh/tp-link/tl-wr703n_bottom.jpg?w=600

Having no access to the board schematic nor to the Atheros AR9331 SoC datasheet and although I am personally an experienced electronic engineer, this work is solely based on observation of the above pictures and experimentation on my own board. For this reason, this work cannot be certified to be 100% accurate or correct, and may well contain errors or mistakes. If you spot some, please report!

We don’t know for sure, but this board looks like it is only double-sided (or only contains a few not very complex internal layers), so studying the above picture should prove good enough to understand the board’s internals. Hopefully someone will take pictures of the bare PCB, so this assertion can be verified!

In order to make it easier to follow on the pictures without jumping back and forth, I decided to explore the picture sequentially (top, then bottom picture), and in a zigzag starting from the top left corner.

PCB Top Side

RESET Switch
SW2 is a R/A SMT tactile momentary switch. The nearby R91/R92 and C62 components are probably used to implement a low-pass filter for filtering out spurious glitches.

MicroUSB Power Connector
USB1 is a R/A SMT MicroUSB socket, out of which only VBUS and GND pins are used to power the device.

The D+/D- and ID remaining pins are unused and can thus be repurposed for another usage, like the D+/D- signals coming out of an USB/TTL UART converter connected to the serial console. Note however that this setup prevents access to the early bootloader character interrupt of the boot sequence, as in this case pluging the USB cable would power the device and not let a user have a chance to type in a character quickly because of the lengthy USB enumeration process.

Please note that the connector shield and GND are not connected together directly, so taking the ground on any connector shield is not a good idea!

Ethernet Connector
J3 is a low-profile passive Ethernet RJ45 socket. It is located into a board cut-out to minimize its overall height. This connector does not contain any LED, nor transformers or EMC filters.

The differential RX/TX signals can be clearly identified, as they are routed away from any other traces with controlled impedance.

C37 is used to connect the Ethernet connector shield to GND.

LED
LED1/LED2 is a dual footprint blue LED, but it looks like the 3 mm through-hole LED2 is never mounted. R83 is the associated current-limiting resistor for the LED.

Note that the round copper pad is not a pad or a test point: it is a “fiducial mark” used for calibrating the component’s pick & place machine during assembly. There are 4 of them on the top side of the board, and 2 (1 is tinned!) on the bottom side.

Ethernet Transformer
T1 is an H1601CG 10/100baseT Single-Port Ethernet Transformer. This device contains both the dual 1:1 isolation transformer with mid-point connection (1 for each RX and TX pair), and the dual common-mode filter (again, 1 for each pair). The purpose of this component is both to provide a galvanic isolation between the internal circuitry and the Ethernet cable pairs, and to filter common-mode noise that may flow on these wires.

The solution to use a separate Ethernet transformer instead of the common integrated “MagJack™” socket is probably economic, but this also provide a better overall isolation because of the increased distance to nearby components.

The resistor/capacitor groups C52/R78/R79/C48/C49 on one side, and R76/R77/C50/C51/C53 on the other side, are 2 sets of common PI filters required for the Ethernet differential signals.

USB Connector
USB2 is a R/A SMT USB-A socket providing an USB host connector. The original purpose is for hooking up a 3G USB dongle, but it can be used for numerous other things.

C113/C115 are used to connect the shield to the GND. 2 parallel capacitors of different values are used, in order to provide a higher band-pass filtering by the overlapping 2 filter poles.

D1 (and D2 on the opposite PCB side) is a dual clamping diode providing ESD (Electro-Static Discharge) protection by limiting the incoming voltages on D+/D- signals to both GND and VBUS.

R101/R102/R103/R104 are USB impedance-matching resistors, in series with both D+ and D- signals. These are required to meet the USB specification, including the famous “eye-diagram”. The use of 2 sets of resistors is rather unusual.

The D+/D- signals can be clearly identified, as they are routed in parallel and away from other signals to provide controlled impedance.

First & Second Undefined Resistor Groups
There are 2 groups of resistors R57/R60/R62/R63 and R15/R16/R17/R18 that have no clear purpose. They look like pull-down resistors for a variety of signals.

A guess would be they are used for POR (Power-On Reset) identification/function selection, but this is infirmed by the fact that R15 has been identified by imperfect as being a pull-down resistor for the GPIO7 signal, and R17 for the GPIO29 signal.

Another guess is that the AR9331 SoC having “diversity” antenna capabilities (i.e. it can use 2 antennas and switch to the best one) and probably also external PA (Power Amplifier) drive capabilities, there may be some GPIO pins in this area that could be used for control purpose. As the TL-WR703N has only a single antenna and no external PA, they are thus unused and pulled down to GND by these resistors.

AR9331 CPU + Integrated Wifi Chipset
U1 is the main AR9331 CPU and Integrated Wifi Chipset from Atheros. Unfortunately, its datasheet is not publicly available, so we can only guess its pinout.

Note that strangely, this chip has 2 concentric rows of pins, as can be observed on NutBolt’s picture of the PCB with unsoldered U1.

C52 looks like a decoupling capacitor for U1, as well as C35/C36, along with the L11 filter choke.

DDR SDRAM
U2 is a 16Mbit x 16bit (16Mibit*16=256 mebibit. 256 mebibit/8=32MiByte) 400MHz chip Zentel A3S56D40FTP DDR1 SDRAM chip, providing 32MB of volatile memory.

This chip can be upgraded to any pin-to-pin compatible 32Mbit x 16bit 400 MHz (or even 333 MHz) DDR1 SDRAM chip to double the RAM capacity.

All the resistors R21/R23/R25/R27/R29/R31/R33/R35/R50/R52, as probably R54/R56 are impedance-matching series resistors for the DDR address/control/data signals.

C103 is a large decoupling capacitor for the DDR SDRAM chip.

Q2 looks like a general-purpose BC849C PNP transistor. Its purpose, as well as the related parts C92/R98 (not mounted)/R106 is unknown, but may be related to the SDRAM chip or the nearby LED.

Note there is a TPDDR test point in the vicinity.

Console UART
R82 is a pull-up resistor for the incoming TP_IN UART RxD signal, and 2 unmounted capacitors C55/C57 can be used for filtering the TP_IN/TP_OUT signals.

These signals seems to be LVTTL (3.3 V) compatible. In order to be usable on a PC, an RS232 level translator or USB/UART converter must be used.

Third Undefined Resistor Group
R4/R11/R12 form an unidentified resistor group, although R4 has been identified by imperfect as a pull-down resistor for the GPIO0 signal.

Crystal
Y1 is a 25 MHz SMT crystal, with the corresponding C60/C61 bank capacitors.

This crystal frequency is used to feed PLLs inside the AR9331 SoC to generate all the required system frequencies (400 MHz for the CPU and SDRAM, 200 MHz for the AHB bus).

Antenna Matching Network
Several RF filter networks can be identified: C33/C34/L6/L7/L8/L9, in parallel to C19/C22/C23/C25/L2/L4, followed by C7/C20/C21/C26/C27/C28/C30/L3/L7.

J1 is a 0 ohm resistor shunt that provides a convenient way to disconnect the printed antenna on the other side of the PCB from the chip. Its pad closest to the U1 chip and the large GND pad on its right can then be used to solder an external antenna.

PCB Bottom Side

Ethernet Connector
The bottom of the J3 Ethernet connector is located into a PCB cut-out. C45 provides the ESD 2kV protection for the Ethernet, and R64/R65/R68/R71 are the Ethernet cable impedance-matching resistors.

First-Level Power Supplies
Right below the USB1 MicroUSB connector is located U6, an unidentified LDO (Low Drop-Out) linear voltage regulator, with its related C119 filter capacitor. The output voltage is unknown (TBD).

R113 (not mounted) is probably a placeholder for a shunt 0 ohm resistor to be mounted as an alternative to U6.

The purpose of the R107/R108/R109/R110/R111/R112 resistor group is unknown, although some kind of resistor dividers for generating miscellaneous voltage references is suspected.

C107/C108 are used to connect the MicroUSB connector shield to GND.

U5 is the main unidentified step-down 3.3 V switching voltage regulator, along with the L14 ferrite-core self, C112 input filter ceramic capacitor, C109 output filter ceramic capacitor and feedback circuit R99/R100/C106.

2 test points TPGND and T3V3 are available, and 2 capacitors C110 (not mouted)/C111 are used to connect the GND to the RF antenna GND.

USB Connector
Below the USB2 connector is the capacitor C114 to connect the USB connector shield to GND, and the D2 dual clamping diode (see description on top PCB side).

Unidentified Transistor
Q1 looks like a BC849C PNP transistor, but its purpose, along with the related components R93 (not mounted)/C70/C84/C47/C38/C46 is unsure.

However, the TP2V0 test point nearby suggests that this circuit might be used for controlling the Ethernet analog voltage at 2.0 V.

DDR SDRAM
Below the U2 DDR1 SDRAM chip are located some additional impedance-matching series resistors for the DDR address/control/data signals R37/R39/R41/R43/R45/R47/R48/R49/R51/R53, R22/R24/R26/R28/R42, R40/R32/R34/R36/R38/R40/R44/R46 and R55/R59/R61.

There are also some decoupling capacitors C9/C10/C11/C12/C13/C14/C15/C16/C17 sprinkled all around.

Please note the serpentine traces for the impedance and length-matched signal between the CPU and the DDR SDRAM chip.

AR9331 CPU + Integrated Wifi Chipset
Below the U1 chip are located a lot of decoupling capacitors C1/C2/C3/C4/C5/C63/C64/C65/C66/C67/C71/C72/C73/C74/C75/C76/C77/C78/C79/C80/C81/C82/C83/C86/C87/C88/C89/C90/C91/C93/C94/C96/C97/C99/C100/C105, 2 self L1 and L13 (this one probably for the Ethernet power supply) and a 0 ohm shunt resistor R94.

Please note the strange central hole below the U1 chip.

Second-Level Power Supplies
It looks like U1 is integrating several LDO voltage regulators, as there are several power supply-related test points TP2V0 (seen above, suspected to provide supply for analog Ethernet), TP2V5 (for supplying the U2 DDR1 SDRAM chip) and TP1V2 (for the core voltage supply).

SPI Flash
U3 is a Spansion S25FL032P 32Mbit 104-MHz SPI Flash memory in SO8 package. This chip provides 4MB of Flash memory for permanent storage.

This chip can be upgraded to a 64 Mbit pin-to-pin compatible chip (like the Eon EN25Q64 chip) to provide 8MB of Flash memory.

C18/C24/C85 are probably decoupling capacitors related to the Flash memory chip U3 or the main CPU chip U1.

The role of the 2 resistors R84 and R95 is unclear, although R95 is large enough to be a possible removable option.

Fourth & Fifth Undefined Resistor Groups
R7/R96/R97 and R2/R3/R13/R14 are undefined resistors whose purpose is unknown.

Antenna
AN1 is the PCB antenna, and C29/C31/C32 (not mounted) are the antenna matching capacitive divider network.

That's all folks!

(Last edited by Squonk on 5 Aug 2012, 15:24)

Nice work! I am impressed. smile Thank you very much, Squonk.

Outstanding work Squonk!

well done squonk, i'm looking forward to breaking down the power supply part. I would like to use this router in a car (14.4V) ;-)

strby wrote:

well done squonk, i'm looking forward to breaking down the power supply part. I would like to use this router in a car (14.4V) ;-)

I suggest you to use a cheap KIS-3R33 module that you can find at < $2 on eBay, for example:
http://www.ebay.com/itm/270953393121

4.75-23V input voltage, output voltage adjustable from 0.925V to 20V, 3A (4A peak) current, 95% efficiency, 21mm x 21mmx 7mm.

Thanks a lot, that's nice and cheap solution :-)

imperfect wrote:

Anyone knows if there are pins to connect a second USB port ?

No, only single USB port. You need to use usb hub

For those who really wants to use their wr703n in some homemade electronic projects.
I've managed to control another 2 gpios, located just near gpio0. It's 2 pads with resistors R11 and R12 on them (gpio14 and gpio15 according to kernel).
However, it required me to modify kernel sources and set some values on the GPIO_FUNCTION register of the AR9331. And it was not possible without a datasheet, of course smile
If there is some interest in it, I can try to prepare patches (never did it before).
As for other functionality, AR9331 has I2S support, GPIO edge/level interrupt support, 4 general purpose timers, subscriber line interface card (SLIC) support
Most of it is not implemented in the current kernel

Did you do this? Even just "svn diff" would get us somewhere smile.  On a more general note, how does the AR9331 handle PIO muxing - is the GPIO_FUNCTION register a centralised pin-function register, or are they spread over the subsystems (eg ethernet, RF...). If the former, then I guess there's the possibility of freeing up even more GPIOs quite easily.

v8rush wrote:
imperfect wrote:

Anyone knows if there are pins to connect a second USB port ?

No, only single USB port. You need to use usb hub

For those who really wants to use their wr703n in some homemade electronic projects.
I've managed to control another 2 gpios, located just near gpio0. It's 2 pads with resistors R11 and R12 on them (gpio14 and gpio15 according to kernel).
However, it required me to modify kernel sources and set some values on the GPIO_FUNCTION register of the AR9331. And it was not possible without a datasheet, of course smile
If there is some interest in it, I can try to prepare patches (never did it before).
As for other functionality, AR9331 has I2S support, GPIO edge/level interrupt support, 4 general purpose timers, subscriber line interface card (SLIC) support
Most of it is not implemented in the current kernel

Did you do this? Even just "svn diff" would get us somewhere smile.  On a more general note, how does the AR9331 handle PIO muxing - is the GPIO_FUNCTION register a centralised pin-function register, or are they spread over the subsystems (eg ethernet, RF...). If the former, then I guess there's the possibility of freeing up even more GPIOs quite easily.

I too would love to see a patch from imperfect

@imperfect: I understand that if you never prepared patches before, the task may looks like daunting... Don't worry, it is not that difficult.

Here is a small receipe:
- get the latest snapshot from svn using the usual methods
- only modified the required files for your modification to work: avoid changing unrelated stuff, spaces/tabs/indents, etc., as these would also be part of the patch
-  go into the top level directory containing the snapshot and issue a "svn diff > my_first.patch"

v8rush wrote:

On a more general note, how does the AR9331 handle PIO muxing - is the GPIO_FUNCTION register a centralised pin-function register, or are they spread over the subsystems (eg ethernet, RF...). If the former, then I guess there's the possibility of freeing up even more GPIOs quite easily.

Check out
http://gpl.back2roots.org/source/fritzb … 240/gpio.c
http://gpl.back2roots.org/source/fritzb … 0/ar7240.h
http://gpl.back2roots.org/source/fritzb … 0/ar933x.h
... some of these german gateway devices (Fritzbox) seems to have utilized more of the ar71xx functionality, and their GPL release has some stuff I haven't seen in other places.

You can grab the whole kernel too: http://gpl.back2roots.org/source/fritzb … nel.tar.gz

There seems to be one register at GPIO_BASE (0x18040000) that selects a pin as input or output, then several function select/mux registers that are rather complicated at GPIO_BASE + 0x28 - 0x40. Some examples of how certain functions get set up are in the above gpio.c file within ar7240_gpio_setup_pin_mode. This could be useful for enabling more GPIOs, but also for using some of the other functions (JTAG, I2S, SPI)

great job

direct use gpio control,the idea is cool

yumbrad wrote:
v8rush wrote:

On a more general note, how does the AR9331 handle PIO muxing - is the GPIO_FUNCTION register a centralised pin-function register, or are they spread over the subsystems (eg ethernet, RF...). If the former, then I guess there's the possibility of freeing up even more GPIOs quite easily.

Check out
http://gpl.back2roots.org/source/fritzb … 240/gpio.c
http://gpl.back2roots.org/source/fritzb … 0/ar7240.h
http://gpl.back2roots.org/source/fritzb … 0/ar933x.h
... some of these german gateway devices (Fritzbox) seems to have utilized more of the ar71xx functionality, and their GPL release has some stuff I haven't seen in other places.

You can grab the whole kernel too: http://gpl.back2roots.org/source/fritzb … nel.tar.gz

There seems to be one register at GPIO_BASE (0x18040000) that selects a pin as input or output, then several function select/mux registers that are rather complicated at GPIO_BASE + 0x28 - 0x40. Some examples of how certain functions get set up are in the above gpio.c file within ar7240_gpio_setup_pin_mode. This could be useful for enabling more GPIOs, but also for using some of the other functions (JTAG, I2S, SPI)

Thanks for that. I browsed through the U-boot and OpenWRT sources, and decided much the same. The GPIO_FUNC register is just a bitmask of 'features', and doesn't have a direct mapping to PIO ids. The fritzbox stuff is interesting though, as I'd not seen how to control the chip selects for SPI (though on OpenWRT, you can use GPIOs directly), and they're probably just remapped GPIOs anyway.

Next thing to do is try modifying the startup code to see if we can free up more GPIOs (I'm guessing this is what imperfect did) by removing them from 'special function' duties. Top of the list to try is the 4 "ethernet switch" LEDs, and if that boots (edit: it did), it's multimeter time to find them...

(Last edited by v8rush on 15 Aug 2012, 09:11)