The point in the boot process happens to be just the exact line I outlined above

Ok, I'll do that.

I found an exact match for the transistors: these are S8550M power PNP transistors. So you are right: these are just the power transistors for 2 internal voltage regulators that regulate the 3.3V supply down to the 2.5V SDRAM supply and the 2.0V analog Ethernet supply. It looks like we achieved full comprehension in this area now!

In order to obtain full circuit understanding, we are left with the unknown USB power switch U6 chip, and the 3.3V unknown buck regulator with internal Schottky diode U5 chip, I could almost draw the schematic 

Although not directly related to the PCB and AR9331 pinout, there is still an interesting unknown area left: the bootstrap jumpers...

I found this section of "arch/mips/include/asm/mach-ath79/ar71xx_regs.h", lines 442-462 particularly interesting:

#define AR933X_BOOTSTRAP_MDIO_GPIO_EN    BIT(18)
#define AR933X_BOOTSTRAP_EEPBUSY    BIT(4)
#define AR933X_BOOTSTRAP_REF_CLK_40    BIT(0)

#define AR934X_BOOTSTRAP_SW_OPTION8    BIT(23)
#define AR934X_BOOTSTRAP_SW_OPTION7    BIT(22)
#define AR934X_BOOTSTRAP_SW_OPTION6    BIT(21)
#define AR934X_BOOTSTRAP_SW_OPTION5    BIT(20)
#define AR934X_BOOTSTRAP_SW_OPTION4    BIT(19)
#define AR934X_BOOTSTRAP_SW_OPTION3    BIT(18)
#define AR934X_BOOTSTRAP_SW_OPTION2    BIT(17)
#define AR934X_BOOTSTRAP_SW_OPTION1    BIT(16)
#define AR934X_BOOTSTRAP_USB_MODE_DEVICE BIT(7)
#define AR934X_BOOTSTRAP_PCIE_RC    BIT(6)
#define AR934X_BOOTSTRAP_EJTAG_MODE    BIT(5)
#define AR934X_BOOTSTRAP_REF_CLK_40    BIT(4)
#define AR934X_BOOTSTRAP_BOOT_FROM_SPI    BIT(2)
#define AR934X_BOOTSTRAP_SDRAM_DISABLED    BIT(1)
#define AR934X_BOOTSTRAP_DDR1        BIT(0)

#define QCA955X_BOOTSTRAP_REF_CLK_40    BIT(4)

From this, I guess that:
- it possible to boot using the MDIO bus. Maybe also boot from USB? Bootstraping from ROM directly to USB (DFU ?) could be nice to recover devices with bricked U-Boot
- the normal 25 MHz crystal can be overclocked to 40 MHz
- it is possible to select USB to work in host or device mode
- it is possible to boot from SPI and probably also internal bootstrap ROM, if booting from SPI is optional
- it is possible to disable SDRAM and choose between DDR1 or DDR2, or maybe select the correct SDRAM/DDR1/DDR2 config

It deserves some more exploration! We just have to play with all the pull-up/pull-downs I marked as "Must have x value during bootstrap" in the main Wiki page GPIO table: when I unsoldered these, I got the device not booting any longer most of the time, but I didn't push further. I guess I need to be a little bit more methodical

I've just published some details of a teardown of the WR703N PCB I did over the weekend.
This contains scans of a completely empty PCB to allow easier viewing, and a full bill of materials I made by removing and measuring each component.
Next step is to trace the PCB and build up a full schematic.

See http://www.kean.com.au/oshw/WR703N/teardown/

Any feedback or correction is welcome.

Cheers,
Kean

Wonderful job!

This will provide invaluable information for reverse-engineering this router.

Thanks!

You need to remove R15 and R17 if you don't want the GPIOs to be pulled to ground.

And you tend to need ground from somewhere (loads of places on the board for that), and maybe a voltage (3.3v?), I'm still looking for the best place to tap into that. My current best guess is one side of the (not mounted) C110 for that.

(Last edited by Martijn on 7 Sep 2012, 11:04)

There is 3.3V on the plus side of LED2: and it is a nice big pad.

Ooh, great. Thanks!

Yes, but don't take the ground on a connector shield: they are not DC connected (only AC, through the large C37/C114 caps).

One nice big spot for ground is on the large pad near the J1 jumper.

A solder iron and tweezers should do the trick without much trouble, but don't heat too much, and heat alternatively both pins until you can pick the chip without effort.

I read about using two irons at the same time and just lifting up the device. I will have to try that some day!

About slipping a blade under, I wanted to try that on memory chips with an old piece of kapton flex ribbon cable from a dead DVD Player but it was just a bit too thick to slide under the chip. There was a part of the cable that had no wires in it that was thin enough but was not long enough.

I will try later with two pieces of kapton tape glued together. Does anyone know if kapton is available without glue on it? I haven't been able to locate any.

The easiest way is to flux the whole resistor, then blob solder over the whole thing. While liquid, you can use braid to pull the whole lot off in one go.
Do not try prying the resitor off unless you are sure it is not connected to the traces, otherwise they WILL lift off.

make sure you hot glue the newly soldered wires down to prevent further lifting/strain.

If you had drop some solder over it, would join both sides,and self-lift, getting catched in the iron

(Last edited by dabyd64 on 12 Sep 2012, 20:24)

The blob, along with the resistor just come off on the tip of the iron (or wick if using). It is very easy.

Someone know if the AR9331 feature more than one serial port?

Any GPIO can be used as a serial port. So yes, it has several.

Clever right, can you expand on that?  where do I start, a kernel module I need to hack I suppose, which one?

EDIT: will it be 3.3V logic or 1.8V ?

(Last edited by HKairpost on 18 Sep 2012, 17:29)

The AR9331 has only one single hardware serial port, see http://wiki.openwrt.org/toh/tp-link/tl- … 331.pinout for details.

Although you cantry to  bit-bang an UART in software using simple GPIO pins, it will never be very efficient and you will not be able to get high bitrates either.

Not counting for accuracy problems with a non real-time multi-tasking kernel that will add up to some 10s of ms of jitter because of random task switching...

Maybe you can try with an USB<->UART adapter, it really depends on your needs.

(Last edited by Squonk on 18 Sep 2012, 20:37)

Ah, I keep forgetting it isn't a RTOS.
My tiny bit of news is that I successfully drag-soldered the new RAM on. Pretty proud of myself as that is the first time I've done it!

Squonk, in the wiki, you state that gpio14,15 must have 0 on boot. I have removed the resistors and the unit still boots. Is that luck, or are there internal pull downs? Or, alternatively, should it be "must not be 1 on boot"?

This isn't me: if you check the Wiki history, this has been modified by "mortimer" in the last revision.

I had no problem with GPIO 14/15 and R11/R12 during my tests, it didn't look like it was used during bootstrap.

Maybe "mortimer" can give us some explanations?

GPIOs 0 6 7 14 15 29 can all be floating (ie resistors removed) without affecting boot on wr703n. I have verified this and edited the WiKi.
I have also added an antenna connector as well as patched into GND, 3v3 and 5v.
As soon as I get a chance I will upload some picks, but due to the flimsy nature of some of the pads I had to hot glue over the solder points in some cases.
Next Job, find a use for this beast

http://sphotos-d.ak.fbcdn.net/hphotos-a … 2417_n.jpg
http://sphotos-g.ak.fbcdn.net/hphotos-a … 7772_n.jpg
pic.twitter.com/f5dtMhgq

Nice Spaghetti plate

I agree with you rob, except that I had problem when I tied GPIO 0 to Vcc: it didn't boot any more (unless I made a mistake  ).

My next set of tests are to make sure I can write 0/1 and then read 0/1 from each GPIO _after_ boot (floating at boot) without causing issues.