这台路由器也算是便宜货了，性能尚可，320MHz 的 MIPS 处理器，16MB 的 RAM 略微有点紧张，关键是 NOR 闪存是 4MB 而不是大多数 W150M 配备的 2MB ，这样就给 OpenWRT 的移植提供了可能。
Tenda 的官方固件一直以来就有 bug ，AP 下的 station 互访困难或者干脆就 ping 不通，NAT 的 bug 也不少，很多特殊协议都无法使用。于是才萌生了把 OpenWRT 塞进去的想法。
W150M 外形比较小巧，可以挂在一个不显眼的地方。
我自己在外壳旁边开了一个小口子，把 TTL UART 引出来了。
正面。
底部的 RJ-45 网络接口和 5V 1.2A 的 MiniUSB 供电接口。
侧面的 Mode 键和 WPS 键。
顶部的指示灯，中间有两个是装饰。最右侧的 LAN/WAN 是由 SoC 内部的无线网卡控制的，其余为 SoC 的 GPIO 控制。
背面，铭牌、序列号贴纸、散热孔、挂钩和两颗螺丝。本来四个角上都有脚贴，后来弄掉了。
由于 LAN/WAN LED 长期处于点亮状态，和其他 LED 一比 LAN/WAN 指示灯已经有明显的光衰了。
卸下两颗螺丝开壳。
外壳内部的 LED 指示灯灯条。
主板正面。
电源输入处的 MLCC 、稳压管和磁珠。
电源输入附近的 8117-ADJ 型可调电压 1A 输出 LDO ，应该是负责提供某些高质量模拟电源的。
非常小巧的贴片式网线变压器，和某些 USB 以太网卡的类似。
PAM2308 双路同步整流 DC-DC 降压芯片，工作频率 1.5MHz ，效率可高达 96% 。后面的“ AA ”表示两路电压均可调。估计这块芯片负责给 SoC 提供 3.3V 和 1.2V 电源。旁边还有两个功率电感和几个较大的 MLCC 。
USB 部分的一些元件（包括两个电阻、一个防浪涌芯片和 USB 插座）都没有焊接，这是 W150M 和 3G150M 的主要区别。
2M × 4bank × 16bit 的 LVTTL SDRAM ，容量 16MB ，工作频率 166MHz 。
空的 SPI NOR 闪存焊位。W150M / W300M / W150M+ / 3G150M / 3G300M 均使用这块 PCB ，而且它们均有使用并行闪存的版本和使用串行闪存的版本。
机器的核心是 Ralink 的 RT3050F APSoC ，一只 40.000MHz 的有源晶振为它提供时钟信号。它和 RT3052F 的主要区别是 RT3052F 支持 2T2R MIMO 。
RT3050F 的主要特征有：
- 320MHz 的 MIPS24KEc 处理器，32K 的指令缓存和 16K 的数据缓存
- 802.11 b/g/n 1T1R 无线支持，支持 20MHz / 40MHz 的 HT ，最多连接 256 个 station ，可同时提供 8 个 BSSID
- WEP / WPA / WPA2 硬件引擎，硬件帧处理，硬件 NAT / QoS / 校验和处理
- 最多支持 32MB 的 16 位 SDR SDRAM
- 最大 16MB 的 8 / 16 位并行 NOR 闪存，最大 64MB 的 NAND 闪存支持，可从 NOR / NAND / ROM Code 引导
- 支持 OTG 的 USB2.0 端口
- 内建 7 口以太网交换机，5 个端口带 10/100Mbps PHY 供外部使用
- GPIO / I2C / SPI /UART / MDIO / JTAG / PCM / I2S 接口
- 3.3V / 1.2V 供电，最大功耗 1.9W
RT305x 系列因为价格便宜、高度集成、设计简单、功能丰富、性能不错（想想看，以前垃圾博通的路由器不都是 200MHz 的 MIPS ？），在近几年的无线路由器里面出镜率很高。
射频部分。主要有滤波器、PA 和天线开关。PCB 上原本设计有屏蔽罩，但是制造的时候省去了。可以看到左边一路是空的，那是为 RT3052F 的 2T2R MIMO 系统预留的。
2.4GHz 射频功放，型号不明。
天线复用开关，同样型号不明。
贴片陶瓷天线，虽然体积小得惊人但是其实信号还可以。整机只有 20dBm / 100mW 的发射功率，但是实际上穿两堵墙问题都不大。
出现光衰的 LED 性状都发生了明显的变化。这 7 个 LED 的外观原本是一样的。
电路板背面。
4MB 的 29 系列并行接口 NOR 闪存，用于存储固件。大部分 W150M 仅配备有 2MB 闪存。
SoC 背面的两个测试点是 TTL UART 的 TX 和 RX 。TP1 接 RX ，TP2 接 TX ，另外还需要找个地方引个地线。
未焊接的 USB 插座背面，省掉了几个电容。
底壳内部。
底壳实际上分为三个部分。
固件方面，这台机器的 bootloader 是 Ralink 修改过的 U-Boot ，功能比较简单，但是非常可靠，不像当年 Marvell 的 U-Boot 让我的 DIR-615 A1 变砖了。而官方固件则是 Ralink 制作的基于 Linux 的系统，似乎 AP 的功能都整合进内核了，并且极度精简，整个系统看起来怪怪的。
W150M / W300M / W150M+ 的官方固件是完全相同的，3G150M / 3G300M 的官方固件也是完全相同的。
为了获得机器的终端，查看输出并输入命令，除了焊好 UART 连接线，接好 USB to TTL UART 转接器以外，还需要把 minicom 的串口模式设置成 57600bps 8N1 。
Ralink 固件引导时的输出：
U-Boot 1.1.3 (Oct 13 2009 - 15:58:57)
Board: Ralink APSoC DRAM: 16 MB
relocate_code Pointer at: 80fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D677
flash_protect ON: from 0xBF030000 to 0xBF030FFF
============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5None)
DRAM component: 128 Mbits SDR
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: NOR Flash
Date:Oct 13 2009 Time:15:58:57
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 320 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =16 Mbytes
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
...................................
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 3
0
3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: W150M_16MB_2MB Kernel Image
Created: 2010-01-04 14:13:54 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1730546 Bytes = 1.7 MB
Load Address: 80000000
Entry Point: 8028c000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8028c000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
LINUX started...
THIS IS ASIC
init started: BusyBox v1.12.1 (2010-01-04 01:04:30 CST)
starting pid 10, tty '': '/etc_ro/rcS'
Welcome to
_______ _______ ___ __ ____ _ _ ___
| ___ \| __ || | |__|| \ | || | / /
| |___| || |__| || |__ __ | \| || |/ /
| _ /| _ || || || |\ || \
|__| \__\|__| |__||______||__||_| \____||_|\___\
=System Architecture Department=
Yes:
****** WeLoveLinux ******
Welcome to ...
httpd Reg gpio hook success .
starting pid 18, tty '/dev/ttyS1': '/bin/sh'
BusyBox v1.12.1 (2010-01-04 01:04:30 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# getIfLive: device eth2.1 not found.
Commit crc = 302b5aa3
maclist:
WLan[C8:3A:35:F8:C8:20]
Lan[C8:3A:35:F8:C8:20]
Wan[C8:3A:35:F8:C8:25]
getIfLive: device br0 not found.
Router ip address config success.
killall: udhcpd: no process killed
ND -> Bad_Sig_entry [18]...
httpd listen ip = 192.168.2.1 port = 80
MfgThread start loop.
TendaLog -> ok rtn.
InitWan:
wan_type: 3
ppp_conn_type:0
ppp_conn_wait_time: 60
ppp_conn_start_min: 0
ppp_conn_end_min: 0
Plugin /etc_ro/ppp/plugins/rp-pppoe.so loaded.
RP-PPPoE plugin version 3.8 compiled against pppd 2.4.4
Plugin init ok.
U-Boot 的默认环境变量：
bootcmd=tftp bootdelay=1 baudrate=57600 ethaddr="00:AA:BB:CC:DD:10" ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp ethact=Eth0 (10/100-M) filesize=1a6832 fileaddr=80800000 ipaddr=192.168.1.2 serverip=192.168.1.11 autostart=no bootfile=W150M.bin stdin=serial stdout=serial stderr=serial
值得一提的是这个 U-Boot 的版本不允许修改 MAC ，内嵌的值是随手输的，也就是说刷入 OpenWRT 以后最好在 UCI 里面手动设置一下 WAN 口的 MAC 地址。bootdelay 完全不起作用，要从菜单中选择启动方式的话需要在菜单出来之前先按下对应的数字，按键操作会被缓存。
固件启动以后在跑的进程：
# ps aux
PID USER VSZ STAT COMMAND
1 0 1356 S init
2 0 0 SWN [ksoftirqd/0]
3 0 0 SW< [events/0]
4 0 0 SW< [khelper]
5 0 0 SW< [kthread]
6 0 0 SW< [kblockd/0]
7 0 0 SW< [kswapd0]
8 0 0 SW [mtdblockd]
16 0 1968 S httpd
18 0 1364 S /bin/sh
29 0 0 SW [RtmpWscTask]
116 0 1120 S netdog
117 0 1968 S httpd
118 0 1968 S httpd
178 0 2316 S pppd file /etc/options.pppoe
192 0 1316 S dnrd -a 192.168.2.1 -R /etc/dnrd -s 211.69.143.16 -s
296 0 788 S /bin/sntp 20
336 0 1364 S udhcpd /etc/udhcpd.conf
341 0 1160 S netctl FilterDaemon
349 0 1352 R ps aux
真是精简到不行了啊。没有 dnsmasq ，没有 miniwpad 或者 hostapd ，都是些专门写的玩意。
ifconfig 的输出：
# ifconfig
br0 Link encap:Ethernet HWaddr C8:3A:35:F8:C8:20
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:827 errors:0 dropped:0 overruns:0 frame:0
TX packets:613 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:106999 (104.4 KiB) TX bytes:235918 (230.3 KiB)
eth2 Link encap:Ethernet HWaddr C8:3A:35:F8:C8:20
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:597 errors:0 dropped:0 overruns:0 frame:0
TX packets:850 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:238542 (232.9 KiB) TX bytes:132589 (129.4 KiB)
Interrupt:3
eth2.1 Link encap:Ethernet HWaddr C8:3A:35:F8:C8:20
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:129 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:23021 (22.4 KiB)
eth2.2 Link encap:Ethernet HWaddr C8:3A:35:F8:C8:25
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:597 errors:0 dropped:0 overruns:0 frame:0
TX packets:721 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:230184 (224.7 KiB) TX bytes:108256 (105.7 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
ppp0 Link encap:Point-to-Point Protocol
inet addr:122.205.83.212 P-t-P:122.205.87.254 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:565 errors:0 dropped:0 overruns:0 frame:0
TX packets:700 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:220773 (215.5 KiB) TX bytes:89278 (87.1 KiB)
ra0 Link encap:Ethernet HWaddr C8:3A:35:F8:C8:20
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4656 errors:0 dropped:0 overruns:0 frame:0
TX packets:686 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:602462 (588.3 KiB) TX bytes:262003 (255.8 KiB)
Interrupt:4
可以看到 ifconfig 的输出挺杂乱的，而且即使是在路由模式下仍有一个打酱油的桥接连接，可能是写死的。另外无线界面名称是 ra0 而不是 wlan0 ，并且带有中断号，因此不可能是基于 mac80211 软件 MAC 的驱动，应该是专有的驱动。
接下来该编译 OpenWRT 了。首先要获得 OpenWRT 的源码：
git clone git://nbd.name/openwrt.git cd openwrt
目前 OpenWRT 还没有 W150M 的支持，但是我已经发了 ticket 。不过短期内还是需要自行 patch 。复制下面的内容：
diff --git a/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom b/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
index 61d79b9..61b348d 100644
--- a/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
+++ b/target/linux/ramips/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
@@ -81,6 +81,7 @@ case "$FIRMWARE" in
v11st-fe | \
v22rw-2x2 | \
w306r-v20 | \
+ w150m | \
w502u | \
wcr-150gn | \
whr-g300n | \
diff --git a/target/linux/ramips/base-files/lib/ramips.sh b/target/linux/ramips/base-files/lib/ramips.sh
index 83dcc0e..62bb342 100755
--- a/target/linux/ramips/base-files/lib/ramips.sh
+++ b/target/linux/ramips/base-files/lib/ramips.sh
@@ -188,6 +188,9 @@ ramips_board_name() {
*"Tenda W306R V2.0")
name="w306r-v20"
;;
+ *"Tenda W150M")
+ name="w150m"
+ ;;
*"TEW-691GR")
name="tew-691gr"
;;
diff --git a/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h b/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
index 384a466..3130d15 100644
--- a/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
+++ b/target/linux/ramips/files/arch/mips/include/asm/mach-ralink/machine.h
@@ -67,6 +67,7 @@ enum ramips_mach_type {
RAMIPS_MACH_MZKW300NH2, /* Planex MZK-W300NH2 Router */
RAMIPS_MACH_XDXRN502J, /* unknown XDX-RN502J */
RAMIPS_MACH_UR_336UN, /* UPVEL ROUTER */
+ RAMIPS_MACH_W150M, /* Tenda W150M */
/* RT3352 based machines */
RAMIPS_MACH_ALL5002, /* Allnet ALL5002 */
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig b/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
index 97258de..28668cf 100644
--- a/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/Kconfig
@@ -169,6 +169,11 @@ config RT305X_MACH_W306R_V20
select RALINK_DEV_GPIO_BUTTONS
select RALINK_DEV_GPIO_LEDS
+config RT305X_MACH_W150M
+ bool "Tenda W150M board support"
+ select RALINK_DEV_GPIO_BUTTONS
+ select RALINK_DEV_GPIO_LEDS
+
config RT305X_MACH_WL341V3
bool "Sitecom WL-341 v3 board support"
select RALINK_DEV_GPIO_BUTTONS
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile b/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
index d38765c..f7e14b4 100644
--- a/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_RT305X_MACH_RT_N10_PLUS) += mach-rt-n10-plus.o
obj-$(CONFIG_RT305X_MACH_SL_R7205) += mach-sl-r7205.o
obj-$(CONFIG_RT305X_MACH_V22RW_2X2) += mach-v22rw-2x2.o
obj-$(CONFIG_RT305X_MACH_W306R_V20) += mach-w306r-v20.o
+obj-$(CONFIG_RT305X_MACH_W150M) += mach-w150m.o
obj-$(CONFIG_RT305X_MACH_W502U) += mach-w502u.o
obj-$(CONFIG_RT305X_MACH_WCR150GN) += mach-wcr150gn.o
obj-$(CONFIG_RT305X_MACH_WHR_G300N) += mach-whr-g300n.o
diff --git a/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c b/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c
new file mode 100644
index 0000000..f990c34
--- /dev/null
+++ b/target/linux/ramips/files/arch/mips/ralink/rt305x/mach-w150m.c
@@ -0,0 +1,103 @@
+/*
+ * Tenda W150M board support
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+
+#include <asm/mach-ralink/machine.h>
+#include <asm/mach-ralink/dev-gpio-buttons.h>
+#include <asm/mach-ralink/dev-gpio-leds.h>
+#include <asm/mach-ralink/rt305x.h>
+#include <asm/mach-ralink/rt305x_regs.h>
+
+#include "devices.h"
+
+#define TENDA_W150M_GPIO_BUTTON_RESET 0
+#define TENDA_W150M_GPIO_BUTTON_MODE 10
+
+#define TENDA_W150M_GPIO_LED_AP 11
+#define TENDA_W150M_GPIO_LED_CLIENTAP 12
+#define TENDA_W150M_GPIO_LED_WDSROUTER 9
+#define TENDA_W150M_GPIO_LED_WIRELESSROUTER 13
+#define TENDA_W150M_GPIO_LED_WISPROUTER 7
+#define TENDA_W150M_GPIO_LED_WPSRESET 14
+
+#define TENDA_W150M_KEYS_POLL_INTERVAL 20
+#define TENDA_W150M_KEYS_DEBOUNCE_INTERVAL (3 * TENDA_W150M_KEYS_POLL_INTERVAL)
+
+static struct gpio_led tenda_w150m_leds_gpio[] __initdata = {
+ {
+ .name = "tenda:blue:ap",
+ .gpio = TENDA_W150M_GPIO_LED_AP,
+ .active_low = 1,
+ },{
+ .name = "tenda:blue:clientap",
+ .gpio = TENDA_W150M_GPIO_LED_CLIENTAP,
+ .active_low = 1,
+ },{
+ .name = "tenda:blue:wdsrouter",
+ .gpio = TENDA_W150M_GPIO_LED_WDSROUTER,
+ .active_low = 1,
+ },{
+ .name = "tenda:blue:wirelessrouter",
+ .gpio = TENDA_W150M_GPIO_LED_WIRELESSROUTER,
+ .active_low = 1,
+ },{
+ .name = "tenda:blue:wisprouter",
+ .gpio = TENDA_W150M_GPIO_LED_WISPROUTER,
+ .active_low = 1,
+ },{
+ .name = "tenda:blue:wpsreset",
+ .gpio = TENDA_W150M_GPIO_LED_WPSRESET,
+ .active_low = 1,
+ }
+};
+
+static struct gpio_keys_button tenda_w150m_gpio_buttons[] __initdata = {
+ {
+ .desc = "reset",
+ .type = EV_KEY,
+ .code = KEY_RESTART,
+ .debounce_interval = TENDA_W150M_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = TENDA_W150M_GPIO_BUTTON_RESET,
+ .active_low = 1,
+ },{
+ .desc = "mode",
+ .type = EV_KEY,
+ .code = BTN_0,
+ .debounce_interval = TENDA_W150M_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = TENDA_W150M_GPIO_BUTTON_MODE,
+ .active_low = 1,
+ }
+};
+
+static void __init tenda_w150m_init(void)
+{
+ rt305x_register_flash(0);
+
+ rt305x_gpio_init(RT305X_GPIO_MODE_GPIO << RT305X_GPIO_MODE_UART0_SHIFT);
+
+ ramips_register_gpio_leds(-1, ARRAY_SIZE(tenda_w150m_leds_gpio),
+ tenda_w150m_leds_gpio);
+
+ ramips_register_gpio_buttons(-1, TENDA_W150M_KEYS_POLL_INTERVAL,
+ ARRAY_SIZE(tenda_w150m_gpio_buttons),
+ tenda_w150m_gpio_buttons);
+
+ rt305x_esw_data.vlan_config = RT305X_ESW_VLAN_CONFIG_LLLLW;
+ rt305x_register_ethernet();
+
+ rt305x_register_wifi();
+
+ rt305x_register_wdt();
+}
+
+MIPS_MACHINE(RAMIPS_MACH_W150M, "W150M", "Tenda W150M",
+ tenda_w150m_init);
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index daceb15..81a9a41 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -467,6 +467,11 @@ define Image/Build/Profile/3G300M
$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,3g300m,3G300M,ttyS1,57600,spi)
endef
+define Image/Build/Profile/W150M
+ $(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,w150m,W150M,ttyS1,57600,phys,W150M Kernel Image,factory.bin)
+ $(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,w150m,W150M,ttyS1,57600,phys)
+endef
+
define Image/Build/Profile/AIR3GII
$(call Image/Build/Template/$(fs_squash)/$(1),GENERIC_4M,air3gii,AIR3GII,ttyS1,57600,spi)
endef
@@ -639,6 +644,7 @@ ifeq ($(CONFIG_RALINK_RT305X),y)
define Image/Build/Profile/Default
$(call Image/Build/Profile/3G6200N,$(1))
$(call Image/Build/Profile/3G300M,$(1))
+ $(call Image/Build/Profile/W150M,$(1))
$(call Image/Build/Profile/AIR3GII,$(1))
$(call Image/Build/Profile/ALL02393G,$(1))
$(call Image/Build/Profile/ALL0256N,$(1))
diff --git a/target/linux/ramips/rt305x/config-3.7 b/target/linux/ramips/rt305x/config-3.7
index db31937..183b7f4 100644
--- a/target/linux/ramips/rt305x/config-3.7
+++ b/target/linux/ramips/rt305x/config-3.7
@@ -133,6 +133,7 @@ CONFIG_RT305X_MACH_SL_R7205=y
CONFIG_RT305X_MACH_UR_336UN=y
CONFIG_RT305X_MACH_V22RW_2X2=y
CONFIG_RT305X_MACH_W306R_V20=y
+CONFIG_RT305X_MACH_W150M=y
CONFIG_RT305X_MACH_W502U=y
CONFIG_RT305X_MACH_WCR150GN=y
CONFIG_RT305X_MACH_WHR_G300N=y
diff --git a/target/linux/ramips/rt305x/profiles/tenda.mk b/target/linux/ramips/rt305x/profiles/tenda.mk
index 10a4cb3..a0ef08d 100644
--- a/target/linux/ramips/rt305x/profiles/tenda.mk
+++ b/target/linux/ramips/rt305x/profiles/tenda.mk
@@ -18,6 +18,17 @@ endef
$(eval $(call Profile,3G300M))
+define Profile/W150M
+ NAME:=Tenda W150M
+ PACKAGES:=
+endef
+
+define Profile/W150M/Description
+ Package set for Tenda W150M board with parallel NOR flash
+endef
+
+$(eval $(call Profile,W150M))
+
define Profile/W306R_V20
NAME:=Tenda W306R V2.0
PACKAGES:=
将它保存为 w150m.patch ，然后执行以下步骤：
git branch you_name_it git checkout you_name_it patch -p1 < w150m.patch
然后
make
漫长的源码包下载和编译就开始了。根据网速和机器的速度这个过程会需要数个小时。编译结束后生成的 U-Boot 镜像会放在 bin/ramips 下。
下面就要准备刷机了。建议先下载官方固件，方便失败以后刷回去。
首先我们需要架设一个 TFTP 服务器。你需要在自己的电脑上安装 tftpd 和 xinetd ，教程很多，在这里不再赘述。接着把 OpenWRT 编译生成的 openwrt-ramips-rt305x-w150m-squashfs-factory.bin 放到 tftp 根目录下。
然后启动路由器。在 minicom 里面看到 U-Boot 输出：
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014 ...................................
时按下键盘上的数字 2 。接着会有一条警告，输入 Y ，然后输入期望的路由器和 TFTP 服务器的地址以及固件的文件名，回车后等待几分钟固件就会刷写完毕。附上 OpenWRT 刷写和第一次启动时的输出：
U-Boot 1.1.3 (Oct 13 2009 - 15:58:57)
Board: Ralink APSoC DRAM: 16 MB
relocate_code Pointer at: 80fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D677
flash_protect ON: from 0xBF030000 to 0xBF030FFF
============================================
Ralink UBoot Version: 3.3
--------------------------------------------
ASIC 3052_MP2 (Port5None)
DRAM component: 128 Mbits SDR
DRAM bus: 16 bit
Total memory: 16 MBytes
Flash component: NOR Flash
Date:Oct 13 2009 Time:15:58:57
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 320 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =16 Mbytes
--->Set rt305x Gpio falsh, added by luowl for w150m, 20091014
...................................
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 2
0
2: System Load Linux Kernel then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.2) ==:192.168.1.2
Input server IP (192.168.1.100) ==:192.168.1.100
Input Linux Kernel filename (w150m/openwrt.bin) ==:w150m/openwrt.bin
netboot_common, argc= 3
NetTxPacket = 0x80FE5880
KSEG1ADDR(NetTxPacket) = 0xA0FE5880
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
Header Payload scatter function is Disable !!
ETH_STATE_ACTIVE!!
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.100; our IP address is 192.168.1.2
Filename 'w150m/openwrt.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:26:2d:9d:1a:62)
Got it
T #
first block received
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################################
done
Bytes transferred = 2228228 (220004 hex)
NetBootFileXferSize= 00220004
Erase linux kernel block !!
From 0xBF050000 To 0xBF27FFFF
b_end =BF3FFFFF
Erase Flash from 0xbf050000 to 0xbf27ffff in Bank # 1
erase sector = 12
sect = 12,s_last = 46,erase poll = 783840
erase sector = 13
sect = 13,s_last = 46,erase poll = 751600
erase sector = 14
*sect = 14,s_last = 46,erase poll = 731264
(blah blah blah ......)
erase sector = 45
*sect = 45,s_last = 46,erase poll = 765272
erase sector = 46
sect = 46,s_last = 46,erase poll = 740606
done
Erased 35 sectors
Copy linux image[2228228 byte] to Flash[0xBF050000]....
Copy to Flash...
Copy 2228228 byte to Flash...
addr = 0xBF0B28A4 ,cnt=1824608
addr = 0xBF11514A ,cnt=1420986
addr = 0xBF1779F0 ,cnt=1017364
addr = 0xBF1DA296 ,cnt=613742
addr = 0xBF23CB3C ,cnt=210120 done
## Booting image at bf050000 ...
Image Name: W150M Kernel Image
Created: 2013-02-01 16:27:04 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 836248 Bytes = 816.6 kB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
Linux version 3.7.5 (dword@dword-as4741g) (gcc version 4.6.4 20121210 (prerelease) (Linaro GCC 4.6-2012.12) ) #3 Sat Feb 2 00:26:54 CST 2013
bootconsole [early0] enabled
CPU revision is: 0001964c (MIPS 24KEc)
Ralink RT3350 id:1 rev:2 running at 320.00 MHz
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone ranges:
Normal [mem 0x00000000-0x00ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00000000-0x00ffffff]
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064
Kernel command line: board=W150M console=ttyS1,57600 mtdparts=physmap-flash.0:192k(u-boot)ro,64k(u-boot-env)ro,64k(factory)ro,896k(kernel),2880k(rootfs),3776k@0x500002
PID hash table entries: 64 (order: -4, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
__ex_table already sorted, skipping sort
Writing ErrCtl register=00026c04
Readback ErrCtl register=00026c04
Memory: 13516k/16384k available (1945k kernel code, 2868k reserved, 328k data, 220k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:48
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
Calibrating delay loop... 212.58 BogoMIPS (lpj=1062912)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is Tenda W150M
bio: create slab at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 26
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
physmap platform flash device: 00800000 at bf000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
Amd/Fujitsu Extended Query Table at 0x0040
Amd/Fujitsu Extended Query version 1.1.
number of CFI chips: 1
6 cmdlinepart partitions found on MTD device physmap-flash.0
Creating 6 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000130000 : "kernel"
0x000000130000-0x000000400000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=270000, len=190000
0x000000270000-0x000000400000 : "rootfs_data"
0x000000050000-0x000000400000 : "firmware"
ramips-wdt ramips-wdt: timeout value must be 0 < timeout <= 40, using 40
TCP: cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 220k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
jffs2 not ready yet; using ramdisk
- init -
Please press Enter to activate this console. Compat-drivers backport release: compat-drivers-2013-01-08-3
Backport based on wireless-testing.git master-2013-01-07
compat.git: wireless-testing.git
cfg80211: Calling CRDA to update world regulatory domain
cfg80211: World regulatory domain updated:
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (214 buckets, 856 max)
ramips-wdt: timeout value 60 must be 0 < timeout <= 40, using 40
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
jffs2: notice: (783) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
BusyBox v1.19.4 (2013-02-01 19:55:38 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
BARRIER BREAKER (Bleeding Edge, r35412)
-----------------------------------------------------
* 1/2 oz Galliano Pour all ingredients into
* 4 oz cold Coffee an irish coffee mug filled
* 1 1/2 oz Dark Rum with crushed ice. Stir.
* 2 tsp. Creme de Cacao
-----------------------------------------------------
root@OpenWrt:/#
最后就该对 OpenWRT 进行设置了。W150M 的内存有点紧张，我没把 Web 控制台编译进去（如果需要的话得更新并安装 feeds ，参见 http://wiki.openwrt.org/doc/devel/feeds ），所以所有的设置是用 UCI 完成的。其实配置文件我都存在电脑上了，刷机完了以后直接 cat 一下就行了。最后别忘了 passwd root 。
说内存紧张是有证据的：
root@BY-21-502:~# cat /proc/meminfo MemTotal: 13736 kB MemFree: 1456 kB Buffers: 272 kB Cached: 1132 kB SwapCached: 0 kB Active: 1672 kB Inactive: 1140 kB Active(anon): 1444 kB Inactive(anon): 56 kB Active(file): 228 kB Inactive(file): 1084 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 1420 kB Mapped: 616 kB Shmem: 92 kB Slab: 4968 kB SReclaimable: 808 kB SUnreclaim: 4160 kB KernelStack: 328 kB PageTables: 280 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 6868 kB Committed_AS: 4884 kB VmallocTotal: 1048372 kB VmallocUsed: 9452 kB VmallocChunk: 1033168 kB
在刚启动以后 Free + Buffer + Cache 就只剩 3MB 不到了，运行一天以后继续降到 2MB 。估计 nat-helpers 比较耗内存，但是没这玩意不高兴啊。好在内存还没爆，忍忍吧。
最后的最后提供 UCI 配置文件样例以供参考：
### /etc/config/dhcp
config dnsmasq
option domainneeded 1
option boguspriv 1
option localise_queries 1
option rebind_protection 1
option rebind_localhost 1
option local '/lan/'
option domain 'lan'
option expandhosts 1
option nonegcache 0
option authoritative 1
option readethers 1
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
list notinterface eth0
config dhcp lan
option interface lan
option start 100
option limit 100
option leasetime 12h
config dhcp wan
option interface wan
option ignore 1
### /etc/config/dropbear
config dropbear
option PasswordAuth 'on'
option RootPasswordAuth 'on'
option Port '22222' # To dodge scanners, set this something other than 22
option Interface 'lan'
### /etc/config/firewall
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
option disable_ipv6 1
config zone
option name lan
option network 'lan'
option input ACCEPT
option output ACCEPT
option forward REJECT
config zone
option name wan
option network 'wan'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config include
option path /etc/firewall.user
### /etc/config/network
config interface loopback
option ifname lo
option proto static
option ipaddr 127.0.0.1
option netmask 255.0.0.0
config interface wan
option proto pppoe
option ifname eth0
option macaddr C8:3A:35:00:00:00 # Change this to your own value, usually 5 greater than wlan0 mac
option username your_pppoe_username
option password your_pppoe_passwd
option timeout 10
config interface lan
option ifname wlan0
option proto static
option ipaddr 192.168.0.1
option netmask 255.255.255.0
### /etc/config/system
config system
option hostname 'BY-21-502' # Change this to your own value
option timezone 'CST-8'
config timeserver 'ntp'
list server '0.openwrt.pool.ntp.org'
list server '1.openwrt.pool.ntp.org'
list server '2.openwrt.pool.ntp.org'
list server '3.openwrt.pool.ntp.org'
option enable_server '0'
# Fancy LED triggers, can be removed.
config led 'sys'
option sysfs 'tenda:blue:ap'
option trigger 'timer'
option delayon '50'
option delayoff '4950'
config led 'ethtx'
option sysfs 'tenda:blue:clientap'
option mode 'rx'
option dev 'eth0'
option trigger 'netdev'
config led 'ethrx'
option sysfs 'tenda:blue:wdsrouter'
option mode 'tx'
option dev 'eth0'
option trigger 'netdev'
config led 'phytx'
option sysfs 'tenda:blue:wisprouter'
option trigger 'phy0rx'
config led 'phyrx'
option sysfs 'tenda:blue:wirelessrouter'
option trigger 'phy0tx'
# eth0 is on switch, it is always up.
#config led 'eth'
# option sysfs 'tenda:blue:wpsreset'
# option mode 'link'
# option dev 'eth0'
# option trigger 'netdev'
config led 'assoc'
option sysfs 'rt2800pci-phy0::radio'
option trigger 'phy0assoc'
### /etc/config/wireless
config wifi-device radio0
option type mac80211
option channel 6 # Select channel carefully to reach max speed
option hwmode 11ng
option path 'platform/rt2800_wmac.0'
option htmode HT20 # Change to HT40 and enable noscan to achieve 150Mbps
list ht_capab GF
list ht_capab SHORT-GI-20
list ht_capab SHORT-GI-40
list ht_capab RX-STBC1
config wifi-iface
option device radio0
option network lan
option mode ap
option ssid your_wifi_essid
option encryption psk2+aes # WPA2 PSK + CCMP/AES is secure.
option key your_wifi_password
大神可以吧固件发我一下么，我的早改好了。就差固件了。内存我来帮你加啊
http://dword1511.info/dword/openwrt/rt305x_w150m_phys_tiny.bin.bz2
仅适用于 4MB 并行闪存版本，不带 USB 支持。
加内存容易，要加了能用得改 bootloader ，很麻烦，而且容易砖。
上传完了以后出现“Linux Kernel image size is too big！！”
下面就不擦除以及写入了。自己编的也是这样
这个至少需要 4MB 闪存的。大部分 W150M 都是 2MB ，我手头的 HP 的版本是 4MB 。
看了芯片型号是一样的呀……回去再确认一下，谢谢回复
也有可能是 bootloader 的问题。
听说SPI FLASH会自动识别内存，能否帮忙编译一份SPI版本？
http://blog.dword1511.info/?p=4017
文章里面有给 SPI 的 uboot 和原厂编程器固件的链接。trunk 版 OpenWRT 的链接：
http://dword1511.info/dword/openwrt/rt305x_3g300m_spi_tiny.bin.bz2 （不带 web 界面）
http://dword1511.info/dword/openwrt/rt305x_3g300m_spi_full.bin.bz2 （含 LuCI ）
感谢！
请问你的无线可以同时开ap和sta两个模式吗？我想建无线桥接，可是配置两个后无线就启动不起来了。两个ap模式是没问题的
我不记得自己在 rt305x 上试过没，你说的启动不起来应该至多是无线连不上吧？
又试了下，好像不行，不知道是驱动不支持还是什么原因。
楼主，我有2个惠普赠品的w150m，想不硬改的情况下，刷DD可以吗？用原厂的UBOOT直接TTL刷的上吗？
Asus RT-N10+ B1/C1/D1 yes no
Asus RT-N13U – yes no
Asus RT-N13U B1 yes no
D-Link DIR-300 B1 yes no
D-Link DIR-600 B1 / B2 yes no
D-Link DIR-615 D1 yes no
D-Link DIR-615 D2 yes no
D-Link DIR-615 D3 yes no
D-Link DIR-615 D4 yes no
上面这些都能刷吧！如果是2M的必须换闪存是吧！谢谢了
对 DD 不太了解。不过 HP 的赠品貌似是 4MB 的闪存，而且 DD 似乎有 2MB 的版本。原厂的 uboot 没有问题，除非要改硬件。
非常感谢！2M的mircoDD没找到合适的，也不敢乱刷，晚上确认一下到底是4M还是2M的闪存。这个路由蛮可爱的，但原厂固件太烂了，总是有莫名其妙的问题，所以一直想换个固件。我有DB120-wg替下来的S2916M闪存，不知道能不能直接换在这个路由上？这两天我先折腾一下DD-wrt吧！有结果再来和楼主交流，再次感谢！
如果有并口闪存编程器的话是可以的，换上去之前需要先写入 uboot 。
没有编程器，并口编程器很贵，呵呵，只有串口的编程器。那看来是没办法换上去了吧？
是的。W150M 也可以改成 SPI 闪存，不过略麻烦。
看你的改造过程了，那可是相当佩服，没这技术，就不改SPI了，哈！其实我想了，如果把16M的闪存在原来的路由器TTL写入w150m支持的UBOOT，然后再摘下来放到w150m上，是否可行呢？
是可行的，但是万一没写好这片闪存就暂时没法用在这两台机器上了。
我以前弄坏2个DB120-wg闪存位的焊盘，懒得飞线，等我有时间练手吧，试试这个方法！就是不知道哪个UBOOT适合w150m，如果你有的话发我邮箱一个，谢了。
Tenda W150M 原厂，并口闪存 + 16MB SDRAM http://dword1511.info/dword/bootloaders/rt305x/nor_tenda_w150m_16m_16b_wan.bin
Ralink APSoC SDK v4.0.1.0 ，并口闪存 + 32MB SDRAM ，没测试过 http://dword1511.info/dword/bootloaders/rt305x/nor_ralink_apsdk4010_32m_16b_all.bin
下载了，等有时间搞一下，这要搞，感觉很刺激，呵呵！要是有个能自动识别内存的全能UBOOT就好了。
lintel 貌似有做
2MB flash
Not supported by dd-wrt, Atheros and Ralink builds needs at least 4MB of flash.
查了一下DD官方，感觉没戏了，主要是我百度到w150m惠普定制版大部分也都是2m闪存，我记得拆开过，印象是2m的，呵呵，那样就没戏了，只能晚上再确认一下了。再次感谢，耽搁你宝贵时间了。
确认了是4M闪存，TTL刷DD最新版成功，中继正常，下载稳定多了，太给力了，呵呵，比腾达的烂系统强太多了，感谢楼主。
你好，很感兴趣w150m刷dd，能不能指导一下怎么看是不是4M和怎么TTL刷DD，非常感谢！
还得请教一个问题，我手头有个HG255D的雷凌原厂固件，怎么样才能改成W150M可用的固件，HG255D的方案是rt3052f，16M闪存32M内存。不知道用winhex怎么拼接固件，还请指点一下。
是不是要换掉雷凌固件里的art部分？
能不能用TTL，先把W150M的uboot、art、fm都备份出来？
编程器固件？目标机器的 uboot 、uboot-env 和 factory 留着。一般是前 320KB 。
不是编程器固件，是TTL刷机固件，应该没有uboot。
TTL 直接刷就可以了，别的应该不用管。
具体我也不太懂，你给我留个邮箱，我把固件发给你看一下可以吗？
Ralink机器哪来的art啊..
朋友怎样才能刷回官方固件。谢谢了。
uboot 下 tftp 官方固件即可。
边拆边喷你也算厉害了
各位高手，这个改造完成了3G也可以上网，机子也很好用，但是如何可以改造为华硕wl-330系统呢，编程刷固件系统，但是wan口不认，如何可以完全改造成华硕的系统玩玩。
Good day.In the experiments Installation 4MB SPI flash was erased factory Winbond W25Q16BV (2MB), need a factory fullflash TENDA W150M ver1.1 or fullflash OpenWRT.Use program SPIPGM linux.In advance thanks
Currently I have 2 fullflash images, one for W150M 2MB flash http://dword1511.info/dword/stockfw/Tenda_W150M.SPI-V1.1_2M_Auto.bin.bz2 , one for 3G150M 4MB flash http://dword1511.info/dword/stockfw/Tenda_3G150M.SPI-V1.1_4M_Auto.bin.bz2 which is also usable on W150M.
Thank you very much.U-boot alive!!!
W150M HP赠品 想刷DD 用哪个固件？
ttl 连接已正常，可是照你说的，按2没反应?
路由器通电，gnd和tx，rx的电压是不是都是3.3V，量了下一根有3.3V，一根没有。正常吗？
博主：我有个W150M，第一次通电后可按MODE键切换模式，半分钟后重启，接下来是不断重启；几分钟后，灯都不亮了，断电再通电Ralink芯片有发热，就是不开机。请教一下怎么处理。