Pinout of AR9331-AL1A in TP-Link TL-WR703N/TL-MR-3020

UPDATE: Here is a link to the full datasheet, from which the detailed pinout:

Here is the currently known pinout of the Atheros AR9331-AL1A chip, as used in the TP-Link TL-WR703N and TL-MR3020 pocket routers:

As explained in this OpenWrt Forum thread, unfortunately, the pinout for the Atheros AR9331 chip is not publicly available.

So, this pinout was obtained by reverse-engineering some routers from TP-Link containing this chip in different configurations:

• In the TL-WR703N, as it is the smallest device with the minimum features
• In the TL-MR3020, as it is a slightly improved device compared to the TL-WR703, featuring more LEDs/switches and a “diversity” antenna
• In the TL-WR741ND, as it is a full-fledge 5 port Wifi router/switch
• In the TL-MR3040, a portable router with battery although a little different from these but all it´s information is in the page

In this regard, the picture of a TL-WR703N PCB taken by forum user “NutBolt” with the AR9331 chip removed was invaluable:

The previous study of TL-WR703N PCB details was also very instructive.

The first problem was to identify this strange package with dual row pinout.

It turned out that this is a “Dual Row MicroLeadFrame ©” (DRMLF) package from Amkor, described here, with drawings available here.

An application Note describing the DRMLF footprint is available here.

The particular Atheros AR9331-AL1A chip is a DRMLF164 164-pin, 0.5 mm pitch, 12×12 mm package, with some missing pins in the corners (2 pins on row “A”, except in NE corner where only 1 row “A” pin is missing, but where a “B pin is missing). These missing pins are filled with white in the pinout picture above. This lefts us with the following available pins numbers:

• West Side : A3-A20, B1-B19
• South Side: A25-A42, B20-B38
• East Side : A47-A65, B39-B56
• North Side: A68-A86, B59-B76

Once the package identified and as it is an SMT device, it is straightforward to identify the pins that are not connected to anything. These pins have been marked as “NC” in the pinout drawing above.

The next step is to identify all the pins that are connected directly to a via: most of the time (not always...), these vias are directly connected to ground or to a power supply rail. These pins have been identified using a small “blue pin” in the pinout drawing above.

Some pins are inter-connected: this is identified by a green line in the pinout drawing.

Until now, everything was easy. Now is the tough job trying to understand the different available functions on the board:

From all the PCB pictures, it is pretty obvious that all the pins on the W/NNW sides are related to the SDRAM, as each pin is routed through a series resistor to an SDRAM chip pin. The exact pinout was not established, as this part is not interesting for hacking these routers, and is left as an exercise to the reader!

The corresponding pins are however outlined in yellow, as will be all the other identified function blocks.

What is striking when looking at the TL-WR741ND PCB picture is the profusion of Ethernet sockets at the bottom of the picture: 5 of them: 1 is blue and probably used for uplink WAN connection, and 4 yellow for LAN connections.

Signals going out of these sockets go through the standard Ethernet “magnetic” transformers for both isolation and common-mode noise filtering (2 dual + 1 single device), then through classical R/C Pi networks, before being routed as dual differential pairs (RX-/RX+ and TX-/TX+) to the AR9331 chip itself.

From this, it is easy to understand that the AR9331 contains an integrated 5x Ethernet switch, out of which only one Ethernet port is used in the TL-WR703N/TL-MR3020 routers. This is probably related to the low-power supply available in these pocket routers.

However, this helps finding some more pins on the AR9331 chip: the 5 Ethernet interfaces are outlined in yellow in the pinout drawing.

Sorry, but it seems difficult to add more Ethernet I/F to the TL-WR703N/TL-MR3020 pocket routers

As it is routed as a differential signal away from all other disturbing traces and very often features series resistors, the USB interface is easy to locate on all PCB pictures, and the corresponding block is outlined in yellow in the pinout drawing.

Same thing as for Ethernet here: the AR9331 only contains a single USB device/host port

For those who aren't lucky to have the pins routed to accesibly pads, and if you can take the risk of DESTROYING YOUR ROUTER this https://forum.openwrt.org/viewtopic.php?id=33991 is an insane mod

The TL-WR703N router only contains a single PCB antenna, whereas the TL-MR3020 router has 2, out of which only one seems to be used, based on the configuration of J1/J2/J4 jumpers. The TL-WR741ND has 2 antennas, 1 on the PCB, and 1 external.

The RF connections to the AR9331 are straightforward, located around the NE corner of the chip, outlined in yellow in the pinout drawing as usual.

The 25 MHz crystal connections to the AR9331 are obvious, also outlined in yellow in the pinout drawing.

We are left with the possible GPIO pins!

Worry free GPIO pins™: If you have some DIY project use GPIO pins 18, 19, 20, 21, 22 and 23 without any worries, these pins are not used during booting. Other GPIO pins are not suitable for use if you don't know exactly what you are doing because they are used during boot process (bootstrap).

Based on experiments and knowledge acquired in the corresponding OpenWrt Forum thread (thanks to everyone there ), using the kernel interface to GPIOs and a digital multi-meter, it has been possible to locate most of the GPIO pins.

Here are the conventions used in the pinout drawing above:

• Labels in red depict GPIOs which seems to be used as bootstrap option switches: they are connected either to GND or VCC through a pull-up/pull-down resistor to provide a 0/1 option bit value for different settings. These pins are thus not recommended for usage as GPIOs, only for passive LEDs. Changing their default value requires some experiments, and most of the time, leads to the device not to boot properly. Hopefully, normal behavior can be restored most of the time by setting them back to the correct level. USE AT YOUR OWN RISKS!
• Values in brackets depict the default value at bootstrap, fixed by a pull-up/pull-down resistor
• Labels is bold face are the known purpose of the corresponding GPIO pin on the TL-WR703N/TL-MR3020 routers
• Labels within parenthesis are the known purpose of the corresponding GPIO pin on the TL-MR3020 router, which is not present en the TL-WR703N router

This pinout is a work in progress (really? see the UPDATE at the top of this page), so don't hesitate to report errors/additions either directly by editing this page or in the OpenWrt forum.