拆解 HP 定制版 Tenda W150M 并为其修改 OpenWRT

这台路由器也算是便宜货了,性能尚可,320MHz 的 MIPS 处理器,16MB 的 RAM 略微有点紧张,关键是 NOR 闪存是 4MB 而不是大多数 W150M 配备的 2MB ,这样就给 OpenWRT 的移植提供了可能。

Tenda 的官方固件一直以来就有 bug ,AP 下的 station 互访困难或者干脆就 ping 不通,NAT 的 bug 也不少,很多特殊协议都无法使用。于是才萌生了把 OpenWRT 塞进去的想法。

P1120300

W150M 外形比较小巧,可以挂在一个不显眼的地方。

我自己在外壳旁边开了一个小口子,把 TTL UART 引出来了。

P1120302

正面。

P1120305

底部的 RJ-45 网络接口和 5V 1.2A 的 MiniUSB 供电接口。

P1120306

侧面的 Mode 键和 WPS 键。

P1120307

顶部的指示灯,中间有两个是装饰。最右侧的 LAN/WAN 是由 SoC 内部的无线网卡控制的,其余为 SoC 的 GPIO 控制。

P1120310

背面,铭牌、序列号贴纸、散热孔、挂钩和两颗螺丝。本来四个角上都有脚贴,后来弄掉了。

P1120312

由于 LAN/WAN LED 长期处于点亮状态,和其他 LED 一比 LAN/WAN 指示灯已经有明显的光衰了。

P1120316

卸下两颗螺丝开壳。

P1120318

外壳内部的 LED 指示灯灯条。

P1120321

主板正面。

P1120322

电源输入处的 MLCC 、稳压管和磁珠。

P1120323

电源输入附近的 8117-ADJ 型可调电压 1A 输出 LDO ,应该是负责提供某些高质量模拟电源的。

P1120324

非常小巧的贴片式网线变压器,和某些 USB 以太网卡的类似。

P1120325

PAM2308 双路同步整流 DC-DC 降压芯片,工作频率 1.5MHz ,效率可高达 96% 。后面的“ AA ”表示两路电压均可调。估计这块芯片负责给 SoC 提供 3.3V 和 1.2V 电源。旁边还有两个功率电感和几个较大的 MLCC 。

P1120326

USB 部分的一些元件(包括两个电阻、一个防浪涌芯片和 USB 插座)都没有焊接,这是 W150M 和 3G150M 的主要区别。

P1120329

2M × 4bank × 16bit 的 LVTTL SDRAM ,容量 16MB ,工作频率 166MHz 。

P1120331

空的 SPI NOR 闪存焊位。W150M / W300M / W150M+ / 3G150M / 3G300M 均使用这块 PCB ,而且它们均有使用并行闪存的版本和使用串行闪存的版本。

P1120332

机器的核心是 Ralink 的 RT3050F APSoC ,一只 40.000MHz 的有源晶振为它提供时钟信号。它和 RT3052F 的主要区别是 RT3052F 支持 2T2R MIMO 。

RT3050F 的主要特征有:

  • 320MHz 的 MIPS24KEc 处理器,32K 的指令缓存和 16K 的数据缓存
  • 802.11 b/g/n 1T1R 无线支持,支持 20MHz / 40MHz 的 HT ,最多连接 256 个 station ,可同时提供 8 个 BSSID
  • WEP / WPA / WPA2 硬件引擎,硬件帧处理,硬件 NAT / QoS / 校验和处理
  • 最多支持 32MB 的 16 位 SDR SDRAM
  • 最大 16MB 的 8 / 16 位并行 NOR 闪存,最大 64MB 的 NAND 闪存支持,可从 NOR / NAND / ROM Code 引导
  • 支持 OTG 的 USB2.0 端口
  • 内建 7 口以太网交换机,5 个端口带 10/100Mbps PHY 供外部使用
  • GPIO / I2C / SPI /UART / MDIO / JTAG / PCM / I2S 接口
  • 3.3V / 1.2V 供电,最大功耗 1.9W

RT305x 系列因为价格便宜、高度集成、设计简单、功能丰富、性能不错(想想看,以前垃圾博通的路由器不都是 200MHz 的 MIPS ?),在近几年的无线路由器里面出镜率很高。

P1120333

射频部分。主要有滤波器、PA 和天线开关。PCB 上原本设计有屏蔽罩,但是制造的时候省去了。可以看到左边一路是空的,那是为 RT3052F 的 2T2R MIMO 系统预留的。

P1120337

2.4GHz 射频功放,型号不明。

P1120335

天线复用开关,同样型号不明。

P1120338

贴片陶瓷天线,虽然体积小得惊人但是其实信号还可以。整机只有 20dBm / 100mW 的发射功率,但是实际上穿两堵墙问题都不大。

P1120339

出现光衰的 LED 性状都发生了明显的变化。这 7 个 LED 的外观原本是一样的。

P1120340

电路板背面。

P1120341

4MB 的 29 系列并行接口 NOR 闪存,用于存储固件。大部分 W150M 仅配备有 2MB 闪存。

P1120342

SoC 背面的两个测试点是 TTL UART 的 TX 和 RX 。TP1 接 RX ,TP2 接 TX ,另外还需要找个地方引个地线。

P1120344

未焊接的 USB 插座背面,省掉了几个电容。

P1120347

底壳内部。

P1120350

底壳实际上分为三个部分。

固件方面,这台机器的 bootloader 是 Ralink 修改过的 U-Boot ,功能比较简单,但是非常可靠,不像当年 Marvell 的 U-Boot 让我的 DIR-615 A1 变砖了。而官方固件则是 Ralink 制作的基于 Linux 的系统,似乎 AP 的功能都整合进内核了,并且极度精简,整个系统看起来怪怪的。

W150M / W300M / W150M+ 的官方固件是完全相同的,3G150M / 3G300M 的官方固件也是完全相同的。

minicom

为了获得机器的终端,查看输出并输入命令,除了焊好 UART 连接线,接好 USB to TTL UART 转接器以外,还需要把 minicom 的串口模式设置成 57600bps 8N1 。

Ralink 固件引导时的输出:

U-Boot 1.1.3 (Oct 13 2009 - 15:58:57)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D677
flash_protect ON: from 0xBF030000 to 0xBF030FFF
============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5None)
DRAM component: 128 Mbits SDR
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: NOR Flash
Date:Oct 13 2009  Time:15:58:57
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
 SDRAM size =16 Mbytes
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
...................................

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3

 0

3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   W150M_16MB_2MB Kernel Image
   Created:      2010-01-04  14:13:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1730546 Bytes =  1.7 MB
   Load Address: 80000000
   Entry Point:  8028c000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8028c000) ...
## Giving linux memsize in MB, 16

Starting kernel ...

LINUX started...

 THIS IS ASIC
init started: BusyBox v1.12.1 (2010-01-04 01:04:30 CST)
starting pid 10, tty '': '/etc_ro/rcS'
Welcome to
     _______  _______  ___     __  ____   _  _   ___
    |  ___  \|   __  ||   |   |__||    \ | || | /  /
    | |___| ||  |__| ||   |__  __ |     \| || |/  /
    |   _   /|   _   ||      ||  || |\     ||     \
    |__| \__\|__| |__||______||__||_| \____||_|\___\

                     =System Architecture Department=

Yes:

      ****** WeLoveLinux ******

 Welcome to ...
httpd Reg gpio hook success .
starting pid 18, tty '/dev/ttyS1': '/bin/sh'

BusyBox v1.12.1 (2010-01-04 01:04:30 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# getIfLive: device eth2.1 not found.
Commit crc = 302b5aa3
maclist:
WLan[C8:3A:35:F8:C8:20]
Lan[C8:3A:35:F8:C8:20]
Wan[C8:3A:35:F8:C8:25]
getIfLive: device br0 not found.
Router ip address config success.
killall: udhcpd: no process killed
ND -> Bad_Sig_entry [18]...
httpd listen ip = 192.168.2.1 port = 80
MfgThread start loop.
TendaLog -> ok rtn.
InitWan:
wan_type: 3
ppp_conn_type:0
ppp_conn_wait_time: 60
ppp_conn_start_min: 0
ppp_conn_end_min: 0
Plugin /etc_ro/ppp/plugins/rp-pppoe.so loaded.
RP-PPPoE plugin version 3.8 compiled against pppd 2.4.4
Plugin init ok.

U-Boot 的默认环境变量:

bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
filesize=1a6832
fileaddr=80800000
ipaddr=192.168.1.2
serverip=192.168.1.11
autostart=no
bootfile=W150M.bin
stdin=serial
stdout=serial
stderr=serial

值得一提的是这个 U-Boot 的版本不允许修改 MAC ,内嵌的值是随手输的,也就是说刷入 OpenWRT 以后最好在 UCI 里面手动设置一下 WAN 口的 MAC 地址。bootdelay 完全不起作用,要从菜单中选择启动方式的话需要在菜单出来之前先按下对应的数字,按键操作会被缓存。

固件启动以后在跑的进程:

# ps aux
  PID USER       VSZ STAT COMMAND
    1 0         1356 S    init
    2 0            0 SWN  [ksoftirqd/0]
    3 0            0 SW<  [events/0]
    4 0            0 SW<  [khelper]
    5 0            0 SW<  [kthread]
    6 0            0 SW<  [kblockd/0]
    7 0            0 SW<  [kswapd0]
    8 0            0 SW   [mtdblockd]
   16 0         1968 S    httpd
   18 0         1364 S    /bin/sh
   29 0            0 SW   [RtmpWscTask]
  116 0         1120 S    netdog
  117 0         1968 S    httpd
  118 0         1968 S    httpd
  178 0         2316 S    pppd file /etc/options.pppoe
  192 0         1316 S    dnrd -a 192.168.2.1 -R /etc/dnrd -s 211.69.143.16 -s
  296 0          788 S    /bin/sntp 20
  336 0         1364 S    udhcpd /etc/udhcpd.conf
  341 0         1160 S    netctl FilterDaemon
  349 0         1352 R    ps aux

真是精简到不行了啊。没有 dnsmasq ,没有 miniwpad 或者 hostapd ,都是些专门写的玩意。

ifconfig 的输出:

# ifconfig
br0       Link encap:Ethernet  HWaddr C8:3A:35:F8:C8:20
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:827 errors:0 dropped:0 overruns:0 frame:0
          TX packets:613 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:106999 (104.4 KiB)  TX bytes:235918 (230.3 KiB)

eth2      Link encap:Ethernet  HWaddr C8:3A:35:F8:C8:20
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:597 errors:0 dropped:0 overruns:0 frame:0
          TX packets:850 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:238542 (232.9 KiB)  TX bytes:132589 (129.4 KiB)
          Interrupt:3 

eth2.1    Link encap:Ethernet  HWaddr C8:3A:35:F8:C8:20
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:129 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:23021 (22.4 KiB)

eth2.2    Link encap:Ethernet  HWaddr C8:3A:35:F8:C8:25
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:597 errors:0 dropped:0 overruns:0 frame:0
          TX packets:721 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:230184 (224.7 KiB)  TX bytes:108256 (105.7 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:122.205.83.212  P-t-P:122.205.87.254  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:565 errors:0 dropped:0 overruns:0 frame:0
          TX packets:700 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:220773 (215.5 KiB)  TX bytes:89278 (87.1 KiB)

ra0       Link encap:Ethernet  HWaddr C8:3A:35:F8:C8:20
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4656 errors:0 dropped:0 overruns:0 frame:0
          TX packets:686 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:602462 (588.3 KiB)  TX bytes:262003 (255.8 KiB)
          Interrupt:4

可以看到 ifconfig 的输出挺杂乱的,而且即使是在路由模式下仍有一个打酱油的桥接连接,可能是写死的。另外无线界面名称是 ra0 而不是 wlan0 ,并且带有中断号,因此不可能是基于 mac80211 软件 MAC 的驱动,应该是专有的驱动。

接下来该编译 OpenWRT 了。首先要获得 OpenWRT 的源码:

git clone git://nbd.name/openwrt.git
cd openwrt

目前 OpenWRT 还没有 W150M 的支持,但是我已经发了 ticket 。不过短期内还是需要自行 patch 。复制下面的内容:

diff --git a/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom b/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
index 61d79b9..61b348d 100644
--- a/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
+++ b/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
@@ -81,6 +81,7 @@ case "$FIRMWARE" in
 	v11st-fe | \
 	v22rw-2x2 | \
 	w306r-v20 | \
+	w150m | \
 	w502u | \
 	wcr-150gn | \
 	whr-g300n | \
diff --git a/target/linux/ramips/base-files/lib/ramips.sh b/target/linux/ramips/base-files/lib/ramips.sh
index 83dcc0e..62bb342 100755
--- a/target/linux/ramips/base-files/lib/ramips.sh
+++ b/target/linux/ramips/base-files/lib/ramips.sh
@@ -188,6 +188,9 @@ ramips_board_name() {
 	*"Tenda W306R V2.0")
 		name="w306r-v20"
 		;;
+	*"Tenda W150M")
+		name="w150m"
+		;;
 	*"TEW-691GR")
 		name="tew-691gr"
 		;;
diff --git a/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h b/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
index 384a466..3130d15 100644
--- a/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
+++ b/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
@@ -67,6 +67,7 @@ enum ramips_mach_type {
 	RAMIPS_MACH_MZKW300NH2,		/* Planex MZK-W300NH2 Router */
 	RAMIPS_MACH_XDXRN502J,          /* unknown XDX-RN502J */
 	RAMIPS_MACH_UR_336UN,		/* UPVEL ROUTER */
+	RAMIPS_MACH_W150M,		/* Tenda W150M */

 	/* RT3352 based machines */
 	RAMIPS_MACH_ALL5002,		/* Allnet ALL5002 */
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig b/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
index 97258de..28668cf 100644
--- a/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
@@ -169,6 +169,11 @@ config RT305X_MACH_W306R_V20
 	select RALINK_DEV_GPIO_BUTTONS
 	select RALINK_DEV_GPIO_LEDS

+config RT305X_MACH_W150M
+	bool "Tenda W150M board support"
+	select RALINK_DEV_GPIO_BUTTONS
+	select RALINK_DEV_GPIO_LEDS
+
 config RT305X_MACH_WL341V3
 	bool "Sitecom WL-341 v3 board support"
 	select RALINK_DEV_GPIO_BUTTONS
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile b/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
index d38765c..f7e14b4 100644
--- a/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_RT305X_MACH_RT_N10_PLUS)	+= mach-rt-n10-plus.o
 obj-$(CONFIG_RT305X_MACH_SL_R7205)	+= mach-sl-r7205.o
 obj-$(CONFIG_RT305X_MACH_V22RW_2X2)	+= mach-v22rw-2x2.o
 obj-$(CONFIG_RT305X_MACH_W306R_V20) 	+= mach-w306r-v20.o
+obj-$(CONFIG_RT305X_MACH_W150M)		+= mach-w150m.o
 obj-$(CONFIG_RT305X_MACH_W502U)		+= mach-w502u.o
 obj-$(CONFIG_RT305X_MACH_WCR150GN)	+= mach-wcr150gn.o
 obj-$(CONFIG_RT305X_MACH_WHR_G300N)	+= mach-whr-g300n.o
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c b/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c
new file mode 100644
index 0000000..f990c34
--- /dev/null
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c
@@ -0,0 +1,103 @@
+/*
+ *  Tenda W150M board support
+ *
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+
+#include <asm/mach-ralink/machine.h>
+#include <asm/mach-ralink/dev-gpio-buttons.h>
+#include <asm/mach-ralink/dev-gpio-leds.h>
+#include <asm/mach-ralink/rt305x.h>
+#include <asm/mach-ralink/rt305x_regs.h>
+
+#include "devices.h"
+
+#define TENDA_W150M_GPIO_BUTTON_RESET		0
+#define TENDA_W150M_GPIO_BUTTON_MODE		10
+
+#define TENDA_W150M_GPIO_LED_AP			11
+#define TENDA_W150M_GPIO_LED_CLIENTAP		12
+#define TENDA_W150M_GPIO_LED_WDSROUTER		9
+#define TENDA_W150M_GPIO_LED_WIRELESSROUTER	13
+#define TENDA_W150M_GPIO_LED_WISPROUTER		7
+#define TENDA_W150M_GPIO_LED_WPSRESET		14
+
+#define TENDA_W150M_KEYS_POLL_INTERVAL		20
+#define TENDA_W150M_KEYS_DEBOUNCE_INTERVAL	(3 * TENDA_W150M_KEYS_POLL_INTERVAL)
+
+static struct gpio_led tenda_w150m_leds_gpio[] __initdata = {
+	{
+		.name		= "tenda:blue:ap",
+		.gpio		= TENDA_W150M_GPIO_LED_AP,
+		.active_low	= 1,
+	},{
+		.name		= "tenda:blue:clientap",
+		.gpio		= TENDA_W150M_GPIO_LED_CLIENTAP,
+		.active_low	= 1,
+	},{
+		.name		= "tenda:blue:wdsrouter",
+		.gpio		= TENDA_W150M_GPIO_LED_WDSROUTER,
+		.active_low	= 1,
+	},{
+		.name		= "tenda:blue:wirelessrouter",
+		.gpio		= TENDA_W150M_GPIO_LED_WIRELESSROUTER,
+		.active_low	= 1,
+	},{
+		.name		= "tenda:blue:wisprouter",
+		.gpio		= TENDA_W150M_GPIO_LED_WISPROUTER,
+		.active_low	= 1,
+	},{
+		.name		= "tenda:blue:wpsreset",
+		.gpio		= TENDA_W150M_GPIO_LED_WPSRESET,
+		.active_low	= 1,
+	}
+};
+
+static struct gpio_keys_button tenda_w150m_gpio_buttons[] __initdata = {
+	{
+		.desc		= "reset",
+		.type		= EV_KEY,
+		.code		= KEY_RESTART,
+		.debounce_interval = TENDA_W150M_KEYS_DEBOUNCE_INTERVAL,
+		.gpio		= TENDA_W150M_GPIO_BUTTON_RESET,
+		.active_low	= 1,
+	},{
+		.desc		= "mode",
+		.type		= EV_KEY,
+		.code		= BTN_0,
+		.debounce_interval = TENDA_W150M_KEYS_DEBOUNCE_INTERVAL,
+		.gpio		= TENDA_W150M_GPIO_BUTTON_MODE,
+		.active_low	= 1,
+	}
+};
+
+static void __init tenda_w150m_init(void)
+{
+	rt305x_register_flash(0);
+
+	rt305x_gpio_init(RT305X_GPIO_MODE_GPIO << RT305X_GPIO_MODE_UART0_SHIFT);
+
+	ramips_register_gpio_leds(-1, ARRAY_SIZE(tenda_w150m_leds_gpio),
+			tenda_w150m_leds_gpio);
+
+	ramips_register_gpio_buttons(-1, TENDA_W150M_KEYS_POLL_INTERVAL,
+			ARRAY_SIZE(tenda_w150m_gpio_buttons),
+			tenda_w150m_gpio_buttons);
+
+	rt305x_esw_data.vlan_config = RT305X_ESW_VLAN_CONFIG_LLLLW;
+	rt305x_register_ethernet();
+
+	rt305x_register_wifi();
+
+	rt305x_register_wdt();
+}
+
+MIPS_MACHINE(RAMIPS_MACH_W150M, "W150M", "Tenda W150M",
+		tenda_w150m_init);
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index daceb15..81a9a41 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -467,6 +467,11 @@ define Image/Build/Profile/3G300M
 	$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,3g300m,3G300M,ttyS1,57600,spi)
 endef

+define Image/Build/Profile/W150M
+	$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,w150m,W150M,ttyS1,57600,phys,W150M Kernel Image,factory.bin)
+	$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,w150m,W150M,ttyS1,57600,phys)
+endef
+
 define Image/Build/Profile/AIR3GII
 	$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,air3gii,AIR3GII,ttyS1,57600,spi)
 endef
@@ -639,6 +644,7 @@ ifeq ($(CONFIG_RALINK_RT305X),y)
 define Image/Build/Profile/Default
 	$(call Image/Build/Profile/3G6200N,$(1))
 	$(call Image/Build/Profile/3G300M,$(1))
+	$(call Image/Build/Profile/W150M,$(1))
 	$(call Image/Build/Profile/AIR3GII,$(1))
 	$(call Image/Build/Profile/ALL02393G,$(1))
 	$(call Image/Build/Profile/ALL0256N,$(1))
diff --git a/target/linux/ramips/rt305x/config-3.7 b/target/linux/ramips/rt305x/config-3.7
index db31937..183b7f4 100644
--- a/target/linux/ramips/rt305x/config-3.7
+++ b/target/linux/ramips/rt305x/config-3.7
@@ -133,6 +133,7 @@ CONFIG_RT305X_MACH_SL_R7205=y
 CONFIG_RT305X_MACH_UR_336UN=y
 CONFIG_RT305X_MACH_V22RW_2X2=y
 CONFIG_RT305X_MACH_W306R_V20=y
+CONFIG_RT305X_MACH_W150M=y
 CONFIG_RT305X_MACH_W502U=y
 CONFIG_RT305X_MACH_WCR150GN=y
 CONFIG_RT305X_MACH_WHR_G300N=y
diff --git a/target/linux/ramips/rt305x/profiles/tenda.mk b/target/linux/ramips/rt305x/profiles/tenda.mk
index 10a4cb3..a0ef08d 100644
--- a/target/linux/ramips/rt305x/profiles/tenda.mk
+++ b/target/linux/ramips/rt305x/profiles/tenda.mk
@@ -18,6 +18,17 @@ endef

 $(eval $(call Profile,3G300M))

+define Profile/W150M
+	NAME:=Tenda W150M
+	PACKAGES:=
+endef
+
+define Profile/W150M/Description
+	Package set for Tenda W150M board with parallel NOR flash
+endef
+
+$(eval $(call Profile,W150M))
+
 define Profile/W306R_V20
 	NAME:=Tenda W306R V2.0
 	PACKAGES:=

将它保存为 w150m.patch ,然后执行以下步骤:

git branch you_name_it
git checkout you_name_it
patch -p1 < w150m.patch

然后

make

漫长的源码包下载和编译就开始了。根据网速和机器的速度这个过程会需要数个小时。编译结束后生成的 U-Boot 镜像会放在 bin/ramips 下。

下面就要准备刷机了。建议先下载官方固件,方便失败以后刷回去。

首先我们需要架设一个 TFTP 服务器。你需要在自己的电脑上安装 tftpd 和 xinetd ,教程很多,在这里不再赘述。接着把 OpenWRT 编译生成的 openwrt-ramips-rt305x-w150m-squashfs-factory.bin 放到 tftp 根目录下。

然后启动路由器。在 minicom 里面看到 U-Boot 输出:

--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
...................................

时按下键盘上的数字 2 。接着会有一条警告,输入 Y ,然后输入期望的路由器和 TFTP 服务器的地址以及固件的文件名,回车后等待几分钟固件就会刷写完毕。附上 OpenWRT 刷写和第一次启动时的输出:

U-Boot 1.1.3 (Oct 13 2009 - 15:58:57)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D677
flash_protect ON: from 0xBF030000 to 0xBF030FFF
============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5None)
DRAM component: 128 Mbits SDR
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: NOR Flash
Date:Oct 13 2009  Time:15:58:57
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384

 ##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
 SDRAM size =16 Mbytes
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
...................................

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 2

 0

2: System Load Linux Kernel then write to Flash via TFTP.
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.2) ==:192.168.1.2
        Input server IP (192.168.1.100) ==:192.168.1.100
        Input Linux Kernel filename (w150m/openwrt.bin) ==:w150m/openwrt.bin

 netboot_common, argc= 3

 NetTxPacket = 0x80FE5880

 KSEG1ADDR(NetTxPacket) = 0xA0FE5880

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Header Payload scatter function is Disable !!

 ETH_STATE_ACTIVE!! 
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.100; our IP address is 192.168.1.2
Filename 'w150m/openwrt.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:26:2d:9d:1a:62)
Got it
T #
 first block received
################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################
done
Bytes transferred = 2228228 (220004 hex)
NetBootFileXferSize= 00220004
Erase linux kernel block !!
From 0xBF050000 To 0xBF27FFFF

 b_end =BF3FFFFF
Erase Flash from 0xbf050000 to 0xbf27ffff in Bank # 1

 erase sector  = 12
sect = 12,s_last = 46,erase poll = 783840

 erase sector  = 13
sect = 13,s_last = 46,erase poll = 751600

 erase sector  = 14
*sect = 14,s_last = 46,erase poll = 731264

(blah blah blah ......)

 erase sector  = 45
*sect = 45,s_last = 46,erase poll = 765272

 erase sector  = 46
sect = 46,s_last = 46,erase poll = 740606
 done
Erased 35 sectors

 Copy linux image[2228228 byte] to Flash[0xBF050000]....
Copy to Flash...
 Copy 2228228 byte to Flash...
 addr = 0xBF0B28A4 ,cnt=1824608
 addr = 0xBF11514A ,cnt=1420986
 addr = 0xBF1779F0 ,cnt=1017364
 addr = 0xBF1DA296 ,cnt=613742
 addr = 0xBF23CB3C ,cnt=210120 done
## Booting image at bf050000 ...
   Image Name:   W150M Kernel Image
   Created:      2013-02-01  16:27:04 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    836248 Bytes = 816.6 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 16

Starting kernel ...

Linux version 3.7.5 (dword@dword-as4741g) (gcc version 4.6.4 20121210 (prerelease) (Linaro GCC 4.6-2012.12) ) #3 Sat Feb 2 00:26:54 CST 2013
bootconsole [early0] enabled
CPU revision is: 0001964c (MIPS 24KEc)
Ralink RT3350 id:1 rev:2 running at 320.00 MHz
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone ranges:
  Normal   [mem 0x00000000-0x00ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x00ffffff]
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
Kernel command line:  board=W150M console=ttyS1,57600 mtdparts=physmap-flash.0:192k(u-boot)ro,64k(u-boot-env)ro,64k(factory)ro,896k(kernel),2880k(rootfs),3776k@0x500002
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
__ex_table already sorted, skipping sort
Writing ErrCtl register=00026c04
Readback ErrCtl register=00026c04
Memory: 13516k/16384k available (1945k kernel code, 2868k reserved, 328k data, 220k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:48
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is Tenda W150M
bio: create slab  at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
physmap platform flash device: 00800000 at bf000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
6 cmdlinepart partitions found on MTD device physmap-flash.0
Creating 6 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000130000 : "kernel"
0x000000130000-0x000000400000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=270000, len=190000 
0x000000270000-0x000000400000 : "rootfs_data"
0x000000050000-0x000000400000 : "firmware"
ramips-wdt ramips-wdt: timeout value must be 0 < timeout <= 40, using 40
TCP: cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 220k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
jffs2 not ready yet; using ramdisk
- init -

Please press Enter to activate this console. Compat-drivers backport release: compat-drivers-2013-01-08-3
Backport based on wireless-testing.git master-2013-01-07
compat.git: wireless-testing.git
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (214 buckets, 856 max)
ramips-wdt: timeout value 60 must be 0 < timeout <= 40, using 40
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
jffs2: notice: (783) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.

BusyBox v1.19.4 (2013-02-01 19:55:38 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (Bleeding Edge, r35412)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
root@OpenWrt:/#

最后就该对 OpenWRT 进行设置了。W150M 的内存有点紧张,我没把 Web 控制台编译进去(如果需要的话得更新并安装 feeds ,参见 http://wiki.openwrt.org/doc/devel/feeds ),所以所有的设置是用 UCI 完成的。其实配置文件我都存在电脑上了,刷机完了以后直接 cat 一下就行了。最后别忘了 passwd root 。

说内存紧张是有证据的:

root@BY-21-502:~# cat /proc/meminfo
MemTotal:          13736 kB
MemFree:            1456 kB
Buffers:             272 kB
Cached:             1132 kB
SwapCached:            0 kB
Active:             1672 kB
Inactive:           1140 kB
Active(anon):       1444 kB
Inactive(anon):       56 kB
Active(file):        228 kB
Inactive(file):     1084 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1420 kB
Mapped:              616 kB
Shmem:                92 kB
Slab:               4968 kB
SReclaimable:        808 kB
SUnreclaim:         4160 kB
KernelStack:         328 kB
PageTables:          280 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:        6868 kB
Committed_AS:       4884 kB
VmallocTotal:    1048372 kB
VmallocUsed:        9452 kB
VmallocChunk:    1033168 kB

在刚启动以后 Free + Buffer + Cache 就只剩 3MB 不到了,运行一天以后继续降到 2MB 。估计 nat-helpers 比较耗内存,但是没这玩意不高兴啊。好在内存还没爆,忍忍吧。

最后的最后提供 UCI 配置文件样例以供参考:

### /etc/config/dhcp
config dnsmasq
	option domainneeded	1
	option boguspriv	1
	option localise_queries	1
	option rebind_protection 1
	option rebind_localhost 1
	option local		'/lan/'
	option domain		'lan'
	option expandhosts	1
	option nonegcache	0
	option authoritative	1
	option readethers	1
	option leasefile	'/tmp/dhcp.leases'
	option resolvfile	'/tmp/resolv.conf.auto'
	list notinterface	eth0

config dhcp lan
	option interface	lan
	option start		100
	option limit		100
	option leasetime	12h

config dhcp wan
	option interface	wan
	option ignore	 	1
### /etc/config/dropbear
config dropbear
	option PasswordAuth	'on'
	option RootPasswordAuth	'on'
	option Port		'22222' # To dodge scanners, set this something other than 22
	option Interface	'lan'
### /etc/config/firewall
config defaults
	option syn_flood	1
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT
	option disable_ipv6	1

config zone
	option name		lan
	option network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		REJECT

config zone
	option name		wan
	option network		'wan'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config include
	option path /etc/firewall.user
### /etc/config/network
config interface loopback
        option ifname	lo
        option proto	static
        option ipaddr	127.0.0.1
        option netmask	255.0.0.0

config interface wan
	option proto	pppoe
	option ifname	eth0
	option macaddr	C8:3A:35:00:00:00 # Change this to your own value, usually 5 greater than wlan0 mac
	option username	your_pppoe_username
	option password	your_pppoe_passwd
	option timeout	10

config interface lan
        option ifname	wlan0
        option proto	static
        option ipaddr	192.168.0.1
        option netmask	255.255.255.0
### /etc/config/system
config system
	option hostname		'BY-21-502' # Change this to your own value
	option timezone		'CST-8'

config timeserver 'ntp'
	list server		'0.openwrt.pool.ntp.org'
	list server		'1.openwrt.pool.ntp.org'
	list server		'2.openwrt.pool.ntp.org'
	list server		'3.openwrt.pool.ntp.org'
	option enable_server	'0'

# Fancy LED triggers, can be removed.
config led 'sys'
	option sysfs		'tenda:blue:ap'
	option trigger		'timer'
	option delayon		'50'
	option delayoff		'4950'

config led 'ethtx'
	option sysfs		'tenda:blue:clientap'
	option mode		'rx'
	option dev		'eth0'
	option trigger		'netdev'

config led 'ethrx'
	option sysfs		'tenda:blue:wdsrouter'
	option mode		'tx'
	option dev		'eth0'
	option trigger		'netdev'

config led 'phytx'
	option sysfs		'tenda:blue:wisprouter'
	option trigger		'phy0rx'

config led 'phyrx'
	option sysfs		'tenda:blue:wirelessrouter'
	option trigger		'phy0tx'

# eth0 is on switch, it is always up.
#config led 'eth'
#	option sysfs		'tenda:blue:wpsreset'
#	option mode		'link'
#	option dev		'eth0'
#	option trigger		'netdev'

config led 'assoc'
	option sysfs		'rt2800pci-phy0::radio'
	option trigger		'phy0assoc'
### /etc/config/wireless
config wifi-device	radio0
	option type	mac80211
	option channel	6 # Select channel carefully to reach max speed
	option hwmode	11ng
	option path	'platform/rt2800_wmac.0'
	option htmode	HT20 # Change to HT40 and enable noscan to achieve 150Mbps
	list ht_capab	GF
	list ht_capab	SHORT-GI-20
	list ht_capab	SHORT-GI-40
	list ht_capab	RX-STBC1

config wifi-iface
	option device	radio0
	option network	lan
	option mode	ap
	option ssid	your_wifi_essid
	option encryption psk2+aes # WPA2 PSK + CCMP/AES is secure.
	option key	your_wifi_password

《拆解 HP 定制版 Tenda W150M 并为其修改 OpenWRT》有43个想法

  1. 请问你的无线可以同时开ap和sta两个模式吗?我想建无线桥接,可是配置两个后无线就启动不起来了。两个ap模式是没问题的

  2. 楼主,我有2个惠普赠品的w150m,想不硬改的情况下,刷DD可以吗?用原厂的UBOOT直接TTL刷的上吗?
    Asus RT-N10+ B1/C1/D1 yes no
    Asus RT-N13U – yes no
    Asus RT-N13U B1 yes no
    D-Link DIR-300 B1 yes no
    D-Link DIR-600 B1 / B2 yes no
    D-Link DIR-615 D1 yes no
    D-Link DIR-615 D2 yes no
    D-Link DIR-615 D3 yes no
    D-Link DIR-615 D4 yes no
    上面这些都能刷吧!如果是2M的必须换闪存是吧!谢谢了

      1. 非常感谢!2M的mircoDD没找到合适的,也不敢乱刷,晚上确认一下到底是4M还是2M的闪存。这个路由蛮可爱的,但原厂固件太烂了,总是有莫名其妙的问题,所以一直想换个固件。我有DB120-wg替下来的S2916M闪存,不知道能不能直接换在这个路由上?这两天我先折腾一下DD-wrt吧!有结果再来和楼主交流,再次感谢!

          1. 没有编程器,并口编程器很贵,呵呵,只有串口的编程器。那看来是没办法换上去了吧?

  3. 看你的改造过程了,那可是相当佩服,没这技术,就不改SPI了,哈!其实我想了,如果把16M的闪存在原来的路由器TTL写入w150m支持的UBOOT,然后再摘下来放到w150m上,是否可行呢?

      1. 我以前弄坏2个DB120-wg闪存位的焊盘,懒得飞线,等我有时间练手吧,试试这个方法!就是不知道哪个UBOOT适合w150m,如果你有的话发我邮箱一个,谢了。

          1. 下载了,等有时间搞一下,这要搞,感觉很刺激,呵呵!要是有个能自动识别内存的全能UBOOT就好了。

  4. 2MB flash

    Not supported by dd-wrt, Atheros and Ralink builds needs at least 4MB of flash.

    查了一下DD官方,感觉没戏了,主要是我百度到w150m惠普定制版大部分也都是2m闪存,我记得拆开过,印象是2m的,呵呵,那样就没戏了,只能晚上再确认一下了。再次感谢,耽搁你宝贵时间了。

    1. 确认了是4M闪存,TTL刷DD最新版成功,中继正常,下载稳定多了,太给力了,呵呵,比腾达的烂系统强太多了,感谢楼主。

  5. 还得请教一个问题,我手头有个HG255D的雷凌原厂固件,怎么样才能改成W150M可用的固件,HG255D的方案是rt3052f,16M闪存32M内存。不知道用winhex怎么拼接固件,还请指点一下。

  6. 各位高手,这个改造完成了3G也可以上网,机子也很好用,但是如何可以改造为华硕wl-330系统呢,编程刷固件系统,但是wan口不认,如何可以完全改造成华硕的系统玩玩。

  7. Good day.In the experiments Installation 4MB SPI flash was erased factory Winbond W25Q16BV (2MB), need a factory fullflash TENDA W150M ver1.1 or fullflash OpenWRT.Use program SPIPGM linux.In advance thanks

发表评论

电子邮件地址不会被公开。 必填项已用*标注

您可以使用这些HTML标签和属性: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>