An application Note describing the DRMLF footprint is available here.
The particular Atheros AR9331-AL1A chip is a DRMLF164 164-pin, 0.5 mm pitch, 12×12 mm package, with some missing pins in the corners (2 pins on row “A”, except in NE corner where only 1 row “A” pin is missing, but where a “B pin is missing). These missing pins are filled with white in the pinout picture above. This lefts us with the following available pins numbers:
West Side : A3-A20, B1-B19
South Side: A25-A42, B20-B38
East Side : A47-A65, B39-B56
North Side: A68-A86, B59-B76
Once the package identified and as it is an SMT device, it is straightforward to identify the pins that are not connected to anything. These pins have been marked as “NC” in the pinout drawing above.
Pins with Vias
The next step is to identify all the pins that are connected directly to a via: most of the time (not always…), these vias are directly connected to ground or to a power supply rail. These pins have been identified using a small “blue pin” in the pinout drawing above.
Some pins are inter-connected: this is identified by a green line in the pinout drawing.
Until now, everything was easy. Now is the tough job trying to understand the different available functions on the board:
From all the PCB pictures, it is pretty obvious that all the pins on the W/NNW sides are related to the SDRAM, as each pin is routed through a series resistor to an SDRAM chip pin. The exact pinout was not established, as this part is not interesting for hacking these routers, and is left as an exercise to the reader!
The corresponding pins are however outlined in yellow, as will be all the other identified function blocks.
What is striking when looking at the TL-WR741ND PCB picture is the profusion of Ethernet sockets at the bottom of the picture: 5 of them: 1 is blue and probably used for uplink WAN connection, and 4 yellow for LAN connections.
Signals going out of these sockets go through the standard Ethernet “magnetic” transformers for both isolation and common-mode noise filtering (2 dual + 1 single device), then through classical R/C Pi networks, before being routed as dual differential pairs (RX-/RX+ and TX-/TX+) to the AR9331 chip itself.
From this, it is easy to understand that the AR9331 contains an integrated 5x Ethernet switch, out of which only one Ethernet port is used in the TL-WR703N/TL-MR3020 routers. This is probably related to the low-power supply available in these pocket routers.
However, this helps finding some more pins on the AR9331 chip: the 5 Ethernet interfaces are outlined in yellow in the pinout drawing.
Sorry, but it seems difficult to add more Ethernet I/F to the TL-WR703N/TL-MR3020 pocket routers
As it is routed as a differential signal away from all other disturbing traces and very often features series resistors, the USB interface is easy to locate on all PCB pictures, and the corresponding block is outlined in yellow in the pinout drawing.
Same thing as for Ethernet here: the AR9331 only contains a single USB device/host port
The TL-WR703N router only contains a single PCB antenna, whereas the TL-MR3020 router has 2, out of which only one seems to be used, based on the configuration of J1/J2/J4 jumpers. The TL-WR741ND has 2 antennas, 1 on the PCB, and 1 external.
The RF connections to the AR9331 are straightforward, located around the NE corner of the chip, outlined in yellow in the pinout drawing as usual.
The 25 MHz crystal connections to the AR9331 are obvious, also outlined in yellow in the pinout drawing.
We are left with the possible GPIO pins!
Worry free GPIO pins™:
If you have some DIY project use GPIO pins 18, 19, 20, 21, 22 and 23 without any worries, these pins are not used during booting. Other GPIO pins are not suitable for use if you don't know exactly what you are doing because they are used during boot process (bootstrap).
Based on experiments and knowledge acquired in the corresponding OpenWrt Forum thread (thanks to everyone there ), using the kernel interface to GPIOs and a digital multi-meter, it has been possible to locate most of the GPIO pins.
Here are the conventions used in the pinout drawing above:
Labels in red depict GPIOs which seems to be used as bootstrap option switches: they are connected either to GND or VCC through a pull-up/pull-down resistor to provide a 0/1 option bit value for different settings. These pins are thus not recommended for usage as GPIOs, only for passive LEDs. Changing their default value requires some experiments, and most of the time, leads to the device not to boot properly. Hopefully, normal behavior can be restored most of the time by setting them back to the correct level. USE AT YOUR OWN RISKS!
Values in brackets depict the default value at bootstrap, fixed by a pull-up/pull-down resistor
Labels is bold face are the known purpose of the corresponding GPIO pin on the TL-WR703N/TL-MR3020 routers
Labels within parenthesis are the known purpose of the corresponding GPIO pin on the TL-MR3020 router, which is not present en the TL-WR703N router
This pinout is a work in progress (really? see the UPDATE at the top of this page), so don't hesitate to report errors/additions either directly by editing this page or in the OpenWrt forum.