OpenWrt Forum Archive

Topic: (TL-WR703n / GPIO / Misc) AR9331 pinouts?

The content of this topic has been archived between 7 Oct 2014 and 7 May 2018. Unfortunately there are posts – most likely complete pages – missing.

Kean wrote:
Squonk wrote:

AFAIK, it is never turned off, at least in the OpenWRT kernel.

It is off until some point in the boot process, so power fed back in that port (for example from a cheap hub) won't power the device on.  (but will keep it on once U6 is enabled)

The point in the boot process happens to be just the exact line I outlined above tongue

Kean wrote:
Squonk wrote:

I will update the Wiki page accordingly, if you don't mind (unless you want to do it by yourself?).

I'll leave that to you.  If I have more to contribute, I may do some wiki edits myself.

Ok, I'll do that.

Kean wrote:
Squonk wrote:

What still puzzles me is the exact role of the 2 Q1/Q2 transistors: my guess is that they are used for power-related things.

I hadn't taken much notice of Q1 and Q2 before, so I just did some research.  They are marked "HY4C" and googling indicates it is most likely a general purpose PNP (something like MMBT3906).
Doing some circuit tracing, Q1 and Q2 appear to be used as the power transistors for voltage regulators that regulate the 3.3V supply to other required voltages.
The base connections seem to go back to the Atheros chip, so it presumably handles the regulation but needs external transistors depending on power requirements.
Q1 is for the 2V supply into the ethernet magnetics, and mine measures at about 2.12V out.  Q2 is the the RAM power supply, and measures about 2.45V.

I found an exact match for the transistors: these are S8550M power PNP transistors. So you are right: these are just the power transistors for 2 internal voltage regulators that regulate the 3.3V supply down to the 2.5V SDRAM supply and the 2.0V analog Ethernet supply. It looks like we achieved full comprehension in this area now!

In order to obtain full circuit understanding, we are left with the unknown USB power switch U6 chip, and the 3.3V unknown buck regulator with internal Schottky diode U5 chip, I could almost draw the schematic  cool

Although not directly related to the PCB and AR9331 pinout, there is still an interesting unknown area left: the bootstrap jumpers...

I found this section of "arch/mips/include/asm/mach-ath79/ar71xx_regs.h", lines 442-462 particularly interesting:

#define AR933X_BOOTSTRAP_MDIO_GPIO_EN    BIT(18)
#define AR933X_BOOTSTRAP_EEPBUSY    BIT(4)
#define AR933X_BOOTSTRAP_REF_CLK_40    BIT(0)

#define AR934X_BOOTSTRAP_SW_OPTION8    BIT(23)
#define AR934X_BOOTSTRAP_SW_OPTION7    BIT(22)
#define AR934X_BOOTSTRAP_SW_OPTION6    BIT(21)
#define AR934X_BOOTSTRAP_SW_OPTION5    BIT(20)
#define AR934X_BOOTSTRAP_SW_OPTION4    BIT(19)
#define AR934X_BOOTSTRAP_SW_OPTION3    BIT(18)
#define AR934X_BOOTSTRAP_SW_OPTION2    BIT(17)
#define AR934X_BOOTSTRAP_SW_OPTION1    BIT(16)
#define AR934X_BOOTSTRAP_USB_MODE_DEVICE BIT(7)
#define AR934X_BOOTSTRAP_PCIE_RC    BIT(6)
#define AR934X_BOOTSTRAP_EJTAG_MODE    BIT(5)
#define AR934X_BOOTSTRAP_REF_CLK_40    BIT(4)
#define AR934X_BOOTSTRAP_BOOT_FROM_SPI    BIT(2)
#define AR934X_BOOTSTRAP_SDRAM_DISABLED    BIT(1)
#define AR934X_BOOTSTRAP_DDR1        BIT(0)

#define QCA955X_BOOTSTRAP_REF_CLK_40    BIT(4)

From this, I guess that:
- it possible to boot using the MDIO bus. Maybe also boot from USB? Bootstraping from ROM directly to USB (DFU ?) could be nice to recover devices with bricked U-Boot big_smile
- the normal 25 MHz crystal can be overclocked to 40 MHz
- it is possible to select USB to work in host or device mode
- it is possible to boot from SPI and probably also internal bootstrap ROM, if booting from SPI is optional
- it is possible to disable SDRAM and choose between DDR1 or DDR2, or maybe select the correct SDRAM/DDR1/DDR2 config

It deserves some more exploration! We just have to play with all the pull-up/pull-downs I marked as "Must have x value during bootstrap" in the main Wiki page GPIO table: when I unsoldered these, I got the device not booting any longer most of the time, but I didn't push further. I guess I need to be a little bit more methodical roll

I've just published some details of a teardown of the WR703N PCB I did over the weekend.
This contains scans of a completely empty PCB to allow easier viewing, and a full bill of materials I made by removing and measuring each component.
Next step is to trace the PCB and build up a full schematic.

See http://www.kean.com.au/oshw/WR703N/teardown/

Any feedback or correction is welcome.

Cheers,
Kean

Wonderful job!

This will provide invaluable information for reverse-engineering this router.

Thanks!

johndoe wrote:

can anyone please what is the minimal steps required to access gpio.. here is what I have gathered until now..
1) solder wires to r15 and r17 (for two GPIO's)
2) uninstall gpio led mod
3) install gpio custom mod

anything else ? (do I need to remove r15 and r17 in addition ?)

You need to remove R15 and R17 if you don't want the GPIOs to be pulled to ground.

And you tend to need ground from somewhere (loads of places on the board for that), and maybe a voltage (3.3v?), I'm still looking for the best place to tap into that. My current best guess is one side of the (not mounted) C110 for that.

(Last edited by Martijn on 7 Sep 2012, 13:04)

There is 3.3V on the plus side of LED2: and it is a nice big pad.

robthebrew wrote:

There is 3.3V on the plus side of LED2: and it is a nice big pad.

Ooh, great. Thanks!

Martijn wrote:

And you tend to need ground from somewhere (loads of places on the board for that), and maybe a voltage (3.3v?), I'm still looking for the best place to tap into that. My current best guess is one side of the (not mounted) C110 for that.

Yes, but don't take the ground on a connector shield: they are not DC connected (only AC, through the large C37/C114 caps).

One nice big spot for ground is on the large pad near the J1 jumper.

johndoe wrote:

any tips on how to remove the resistors safely ?

some of suggestions on net were
1) x-acto knife to cut the connections
2) de soldering braids (but I am afraid, it will lift the tracks off board)
3) using solder iron to melt the joint and then slip a blade under it

A solder iron and tweezers should do the trick without much trouble, but don't heat too much, and heat alternatively both pins until you can pick the chip without effort.

I read about using two irons at the same time and just lifting up the device. I will have to try that some day!

About slipping a blade under, I wanted to try that on memory chips with an old piece of kapton flex ribbon cable from a dead DVD Player but it was just a bit too thick to slide under the chip. There was a part of the cable that had no wires in it that was thin enough but was not long enough.

I will try later with two pieces of kapton tape glued together. Does anyone know if kapton is available without glue on it? I haven't been able to locate any.

The easiest way is to flux the whole resistor, then blob solder over the whole thing. While liquid, you can use braid to pull the whole lot off in one go.
Do not try prying the resitor off unless you are sure it is not connected to the traces, otherwise they WILL lift off.

sad make sure you hot glue the newly soldered wires down to prevent further lifting/strain.

johndoe wrote:

I tried alternating between soldering both sides and managed to remove both resistors. While soldering the enameled wire I did lift one of the pads though sad
and to add insult to injury, I realized later that if I was just driving a transistor I didn't need to remove resistors. (from janisalnis, https://www.dropbox.com/sh/ity5ho0jq3vw … inputs.txt )

If you had drop some solder over it, would join both sides,and self-lift, getting catched in the iron neutral

(Last edited by dabyd64 on 12 Sep 2012, 22:24)

The blob, along with the resistor just come off on the tip of the iron (or wick if using). It is very easy.

Someone know if the AR9331 feature more than one serial port?

Any GPIO can be used as a serial port. So yes, it has several.

Clever right, can you expand on that?  where do I start, a kernel module I need to hack I suppose, which one?

EDIT: will it be 3.3V logic or 1.8V ?

(Last edited by HKairpost on 18 Sep 2012, 19:29)

The AR9331 has only one single hardware serial port, see http://wiki.openwrt.org/toh/tp-link/tl- … 331.pinout for details.

Although you cantry to  bit-bang an UART in software using simple GPIO pins, it will never be very efficient and you will not be able to get high bitrates either.

Not counting for accuracy problems with a non real-time multi-tasking kernel that will add up to some 10s of ms of jitter because of random task switching...

Maybe you can try with an USB<->UART adapter, it really depends on your needs.

(Last edited by Squonk on 18 Sep 2012, 22:37)

Ah, I keep forgetting it isn't a RTOS.
My tiny bit of news is that I successfully drag-soldered the new RAM on. Pretty proud of myself as that is the first time I've done it!

Squonk, in the wiki, you state that gpio14,15 must have 0 on boot. I have removed the resistors and the unit still boots. Is that luck, or are there internal pull downs? Or, alternatively, should it be "must not be 1 on boot"?

robthebrew wrote:

Squonk, in the wiki, you state that gpio14,15 must have 0 on boot. I have removed the resistors and the unit still boots. Is that luck, or are there internal pull downs? Or, alternatively, should it be "must not be 1 on boot"?

This isn't me: if you check the Wiki history, this has been modified by "mortimer" in the last revision.

I had no problem with GPIO 14/15 and R11/R12 during my tests, it didn't look like it was used during bootstrap.

Maybe "mortimer" can give us some explanations?

GPIOs 0 6 7 14 15 29 can all be floating (ie resistors removed) without affecting boot on wr703n. I have verified this and edited the WiKi.
I have also added an antenna connector as well as patched into GND, 3v3 and 5v.
As soon as I get a chance I will upload some picks, but due to the flimsy nature of some of the pads I had to hot glue over the solder points in some cases.
Next Job, find a use for this beast wink

Nice Spaghetti plate smile

I agree with you rob, except that I had problem when I tied GPIO 0 to Vcc: it didn't boot any more (unless I made a mistake  roll).

My next set of tests are to make sure I can write 0/1 and then read 0/1 from each GPIO _after_ boot (floating at boot) without causing issues.