OpenWrt Forum Archive

Topic: 3G / HSPA Router with SIM CARD slot

The content of this topic has been archived between 6 Apr 2018 and 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello!

I´m trying to find a router with a SIM card slot (I don´t want to use a USB dongle)

I have found very interesting:
-the OPTION Globesurfer III / III+
-the Huawey 970,
-the SOLWISE NET-3G-434T (http://www.solwise.co.uk/3g-routers-434t.htm) in ALTERNATE under the name of "super 3G router"

but I need another more alternative. WE WANT LINUX inside!    Any idea?

My boss is suspicious about the quality of the Solwise and the Huawey and the Globesurfer is too expensive. Any more idea? We want it to use in a permanent way but we have no money to buy an industrial gateway (300€) like has the automatic money machines.

PD:I have found an interesting  D´Link, the DWR-455 but it is an extrange case: I found the datasheet on the D´Link  webpage but no one shop where to buy it. Any idea?

Thanks a lot for the help smile

my suggestion goes to huawei b970b ,as per trial. (I tried option n huawei), but not the third router, but huawei does not have linux access easily, only to few options.

(Last edited by nos_com71 on 5 Mar 2012, 22:54)

Hi,

Did you ever find any good alternative that both have a simcard and supports OpenWrt?
I did some googling on Mikrotik RouterBOARD 411 and was hoping for finding someone that have built a router with 3g and where selling it.. but nothing.

Cheers
-Anders

What about HUAWEI E970/E960 does all things work or where their some problems?
Seem to be supported by OpenWrt and has in included sim card.

Someone that has one can maybe give us a message, just telling if you like it or not?

Regards
-Anders

(Last edited by carlberg on 23 Sep 2012, 06:35)

Hi,

Found some more routers with simcard slot.
Does anyone knows if they can work with openwrt?
Cant find them in the supported devices list, but many routers are using the same hardware, so maybe there is hope?!

Solwise NET-3G-51R
http://www.solwise.co.uk/3g-routers-3g-51r.html
Or any of the other NET-3G-xxxxx routers from Solwise that has simcard slot

Amigo BR183n (same as SAPIDO MB1112 says google)
http://www.amigo.com.tw/en/goods.php?act=view&no=10

YOYORouter BE5
http://www.yoyomotion.com/aboutyoyorouters.html#BE5

Maxcomm WR-72
http://www.maxcomm.com.tw/3g_hsdpa.htm#3

Optus InZone Modem (same as Huawei 960)
http://help.optuszoo.com.au/help/wirele … elessmodem

Regards
/Anders

(i just bought a e960 on ebay, will try it out with openwrt when it comes and I have already a Option Globesurfer III+)

(Last edited by carlberg on 25 Sep 2012, 23:26)

I'd go for a router with USB and connect a 3G USB dongle to it :-)

I did some googling on Option GlobeSurfer III+, looking in firmware file and it seems to be using the BCM5354 chip.
------------------------
rg_hw: BCM5354
dist: GS3
prod_version: 4.10.3
version: 41003
ext_ver: R1N88
modem_version: 1.8.4.4
--------------------------------
And I found it in the list of supported platforms, https://dev.openwrt.org/wiki/platformssmile
(Cant see any name of the chip when opening the box, it is all covered.)

Then it is the question of memory, the chip spec. says: 1-32Mb Flash and 2-128Mb RAM.
But I dont know what this router has..and I dont know how to check it.. The firmware file is ~14Mb, dont know it that helps.
If the firmware is 14Mb, I guess the flash/ram needs to be atleast the same size?

This means that this router should work with OpenWrt, right? smile

I still need to figure out where the serial console is on the board... neutral

Please, someone that knows how to do these type of things, help me..

Cheers
-Anders

(Last edited by carlberg on 24 Sep 2012, 20:50)

I have a GlobeSurfer III+ with the 3G module (out-of-the-box) (same as the GlobeSurfer III but with a 3G module included).
The module is a GTM661W (http://www.option.com/product/986/)

Cheers
-Anders

okey, here we go... newbe in action. smile

I started by downloading a firmware file (217_FW_GS3_R1N88.rmt) from www.option.com and flash it, just to make sure I have a original image that works.

Then I attached a usb stick to the router and started a ssh shell from the GlobeSurfer> prompt, this by running: system shell
I copied the image openwrt-brcm47xx-squashfs.trx from /mnt/fs/A/ to /tmp/ of the router.

I ran: flash layout from the GlobeSurfer boot> prompt and got this.

Flash layout:

Section 00 Type UNKNOWN    Range 0x00000000-0x00040000 MaxSize 0x00040000
        No more information.

Section 01 Type IMAGE      Range 0x00040000-0x00840000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Image downloaded from: http://liveupdate1.option.com/option/FW_GS3_R1N84.rmt?u=KEdsb2JlU3VyZmVyIGRhdGEKICAod2JtCiAgICAodGhlbWUo'
        Checksum 0x3F5D8D97 Counter 0x00000127 Start Offset 0x00000000

Section 02 Type IMAGE      Range 0x00840000-0x01040000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Wed Jan  1 01:21:41 2003'
        Checksum 0x3F598766 Counter 0x00000144 Start Offset 0x00000000

Section 03 Type UNKNOWN    Range 0x01040000-0x01FA0000 MaxSize 0x00F5FF6C
        Size 0x006909C6 Name 'Downloaded at: Wed Jan  1 01:21:41 2003'
        Checksum 0x34503D6E Counter 0x00000143 Start Offset 0x00000000

Section 04 Type CONF       Range 0x01FA0000-0x01FC0000 MaxSize 0x0001FF6C
        Size 0x00004E47 Name 'rg_conf'
        Checksum 0x002750E1 Counter 0x00000146 Start Offset 0x00000000

Section 05 Type CONF       Range 0x01FC0000-0x01FE0000 MaxSize 0x0001FF6C
        Size 0x00004E4E Name 'rg_conf'
        Checksum 0x00277739 Counter 0x00000148 Start Offset 0x00000000

Section 06 Type FACTORY    Range 0x01FE0000-0x01FF0000 MaxSize 0x0000FF6C
        Size 0x000012C1 Name 'rg_factory'
        Checksum 0x0004F911 Counter 0x00000110 Start Offset 0x00000000

Section 07 Type UNKNOWN    Range 0x01FF0000-0x02000000 MaxSize 0x00010000
        No more information.


Do I dare to flash now? (whew)

Cheers
-Anders

oopss..

Device eth0:  hwaddr 00-0C-E3-6F-F7-FE, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:raw Dev:flash0.os0 File: Options:(null)
RG offset = bc040000
Loading: . 0 bytes read
Failed.
Could not load flash0.os0:: Error
CFE>

Thats not the way.. smile
Need to set the offset or something maybe?

Hi,

I am afraid a bricked my router! sad
I ran the flash command from the prompt and ending up at CFE.

Then I tried to get back to original running:
CFE> flash -noheader 192.168.1.10:217_FW_GS3_R1N88.rmt flash0
Reading 192.168.1.10:217_FW_GS3_R1N88.rmt: Done. 15100528 bytes read
Programming...done. 15100528 bytes written
*** command status = 0

I rebooted and now the router doesn’t even respond on the ttl console.

Don’t know what happened, but it is obvious I did something very wrong.
Now all that happends when I plug in the power to the router, is that the lan ports lights up for a few seconds and then nothing. No response on serial port, nothing.

                                  RIP
                         GlobeSurfer III+
                            2013-01-24

Roger and out!
- Carlberg

Hi,

I got some GlobeSurfer3+ i would like to customize.

anarchy99, did you found the jtag pins ? I was thinking i could dump the flash content of my device for you to try.

Is there any new information on the .rmt file archive ?

Kyklas

I remembered that i looked at what Leland Flynn did on it's router's image. This page is well done and i manage to read the image.

http://this8bitlife.com/adventures-in-l … -firmware/

Here some result :

hexdump -C FW_GS3_R1N89.rmt > dumps/FW.hex

00000000  00 7d 60 00 6c 5e 4c 7a  bc 00 1f 62 c0 24 7d f0  |.}`.l^Lz¼..bÀ$}ð|
00000010  d2 19 ce e7 37 71 d5 a8  f3 af 79 27 12 a1 2e d1  |Ò.Îç7qÕ¨ó¯y'.¡.Ñ|
00000020  56 95 f3 6a 00 68 f8 8d  b5 f8 3e 17 79 f0 53 c9  |V.ój.hø.µø>.yðSÉ|
00000030  b1 41 ca e4 27 31 fd dd  73 74 61 72 74 20 73 65  |±AÊä'1ýÝstart se|
00000040  63 74 69 6f 6e 0a 72 67  5f 68 77 3a 20 42 43 4d  |ction.rg_hw: BCM|
00000050  35 33 35 34 0a 64 69 73  74 3a 20 47 53 33 0a 70  |5354.dist: GS3.p|
00000060  72 6f 64 5f 76 65 72 73  69 6f 6e 3a 20 34 2e 31  |rod_version: 4.1|
00000070  30 2e 33 0a 76 65 72 73  69 6f 6e 3a 20 34 31 30  |0.3.version: 410|
00000080  30 33 0a 65 78 74 5f 76  65 72 3a 20 52 31 4e 38  |03.ext_ver: R1N8|
00000090  39 0a 6d 6f 64 65 6d 5f  76 65 72 73 69 6f 6e 3a  |9.modem_version:|
000000a0  20 31 2e 38 2e 34 2e 36  0a 00 48 44 52 30 00 60  | 1.8.4.6..HDR0.`|
000000b0  7d 00 ce 73 23 ce 00 00  01 00 1c 00 00 00 00 00  |}.Îs#Î..........|
000000c0  00 00 00 00 00 00 1f 8b  08 08 e0 2a 75 51 02 03  |..........à*uQ..|
000000d0  6a 6d 70 5f 62 6f 6f 74  2e 62 69 6e 00 e3 61 50  |jmp_boot.bin.ãaP|
000000e0  10 64 00 03 8d 5e 13 21  2e 9b 8a 30 2f 53 76 06  |.d...^.!...0/Sv.|
000000f0  2e 51 90 08 0b 83 66 2f  90 b4 91 71 68 51 51 50  |.Q....f/.´.qhQQP|
00000100  e8 64 e0 60 68 00 ab 3c  b2 1f 22 06 e3 23 03 01  |èdà`h.«<².".ã#..|
00000110  76 06 ac 00 00 75 96 4b  2a 68 00 00 00 00 00 00  |v.¬..u.K*h......|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

strings -n 3 FW_GS3_R1N89.rmt > dumps/FW.str

l^Lz
start section
rg_hw: BCM5354
dist: GS3
prod_version: 4.10.3
version: 41003
ext_ver: R1N89
modem_version: 1.8.4.6
HDR0
*uQ
jmp_boot.bin
0/Sv
qhQQP
K*h

binwalk FW_GS3_R1N89.rmt > dumps/FW_binwalk

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
170             0xAA            TRX firmware header, little endian, header size: 28 bytes,  image size: 8216576 bytes, CRC32: 0xCE2373CE flags/version: 0x10000
198             0xC6            gzip compressed data, was "jmp_boot.bin", from Unix, last modified: Mon Apr 22 14:19:44 2013, max compression
27606           0x6BD6          gzip compressed data, was "vmlinux.bin", from Unix, last modified: Mon Apr 22 14:19:40 2013, max compression
14677548        0xDFF62C        gzip compressed data, ASCII, has CRC, extra field, has comment, last modified: Thu Dec 22 18:21:26 2011

With the binwalk information I extracted the uImage / vmlinux.bin section :
dd if=FW_GS3_R1N89.rmt of=uImage bs=1 skip=27606 count=14649942

The image is gzip compressed so i run :

cat uImage | gunzip - > vmlinux.bin

The binwalk give the following output

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
Progress: 0.00% (0 / 12509184)

1666861         0x196F2D        LZMA compressed data, properties: 0x88, dictionary size: 524288 bytes, uncompressed size: 270602752 bytes
1677205         0x199795        LZMA compressed data, properties: 0x90, dictionary size: 262144 bytes, uncompressed size: 4608 bytes
1681301         0x19A795        LZMA compressed data, properties: 0x90, dictionary size: 262144 bytes, uncompressed size: 4640 bytes
1898144         0x1CF6A0        Linux kernel version "2.4.21openrg-rmk1 #2 Mon Apr 22 14:19:36 CEST 2013 14:19:36 CEST 2013"
1957631         0x1DDEFF        Copyright string: " 1995-1998 Mark Adler "
2113583         0x20402F        Copyright string: " 1995-2002 Jean-loup Gailly "
2114351         0x20432F        Copyright string: " 1995-2002 Mark Adler "
4190208         0x3FF000        romfs filesystem, version 1 size: 2154800 bytes,  named "rom 51752a1e"
6348800         0x60E000        CramFS filesystem, little endian size 65536 version #2 sorted_dirs CRC 0x41c07c37, edition 0, 114 blocks, 947 files
6414336         0x61E000        CramFS filesystem, little endian size 6094848 version #2 sorted_dirs CRC 0x9fa22d7a, edition 0, 757 blocks, 468 files

I'll try to ungzip the last section of the firmware which contains ASCII data. Maybe there is the rg_conf data in this section.
I'll also post the flash layout i have on my device to match with the firmware's.

Kyklas

Thanks for the info,

I have the following variables in nvram :

boardtype=0x048e
boardrev=0x10

The model is GS0361 on the back sticker.

From what i read on the tutorial, either i flash-load the image by using the ssh console and the unix shell or i compile Attitude Adjustment 12:09 r36088 with the provided patch and then make it recognizable by GS3+ update tool.

Have you manage to roll back to GS3+ firmware after flashing openwrt ?

I need to be able to use the 3G modem to get internet, if i have problems with openwrt doing that i may go back to GS3+ firmware.

Kyklas

(Last edited by Kyklas on 2 Oct 2013, 21:32)

My flash layout is the following :

flash> layout
Flash layout:

Section 00 Type UNKNOWN    Range 0x00000000-0x00040000 MaxSize 0x00040000
        No more information.

Section 01 Type IMAGE      Range 0x00040000-0x00840000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Wed Sep 25 16:57:37 2013'
        Checksum 0x3F5A6B82 Counter 0x000001C8 Start Offset 0x00000000

Section 02 Type IMAGE      Range 0x00840000-0x01040000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Image downloaded from: tftp://192.168.1.2/FW_GS3_R1N88.img'
        Checksum 0x3F598E59 Counter 0x00000120 Start Offset 0x00000000

Section 03 Type UNKNOWN    Range 0x01040000-0x01FA0000 MaxSize 0x00F5FF6C
        Size 0x0068F88D Name 'Downloaded at: Wed Sep 25 16:57:37 2013'
        Checksum 0x344A38EC Counter 0x000001C7 Start Offset 0x00000000

Section 04 Type CONF       Range 0x01FA0000-0x01FC0000 MaxSize 0x0001FF6C
        Size 0x000045E2 Name 'rg_conf'
        Checksum 0x00236CB8 Counter 0x000001D7 Start Offset 0x00000000

Section 05 Type CONF       Range 0x01FC0000-0x01FE0000 MaxSize 0x0001FF6C
        Size 0x000045E2 Name 'rg_conf'
        Checksum 0x00236705 Counter 0x000001D6 Start Offset 0x00000000

Section 06 Type FACTORY    Range 0x01FE0000-0x01FF0000 MaxSize 0x0000FF6C
        Size 0x00001284 Name 'rg_factory'
        Checksum 0x0004EA72 Counter 0x00000124 Start Offset 0x00000000

Section 07 Type UNKNOWN    Range 0x01FF0000-0x02000000 MaxSize 0x00010000
        No more information.

Total 8 sections found.

Returned 0

I have the same layout as carlberg but with the R1N89 firmware on it.

So the bootloader is in section 00 ? Is it U-Boot ?

carlberg can you tell me if you manage to use you router again or is it still bricked ?

Kyklas

(Last edited by Kyklas on 2 Oct 2013, 21:27)

Do you have a link to the image you compile for yours.
I have the << drivers 'n' stuff >> image ( from the 27.08.2013., 23:17 post ) from the web site you gave me the link to, that one work ?

For the backup, i'm able to dump the flash content from the GS CLI but the output is in text form. Could i create a image of the flash with the dd command. Which device should i use in /dev ? Or does the flash dump is done in the bootloader CFE ?

I have a usb-serial adapter i'll try. Do i need to connect inside or can i use the GS usb to connect the adapter ? ( I know that sounds silly but the kernel look for a usb-serial adapter during boot )

You flashed at address 0x00040000 ? Is there a risk of rewriting the bootloader ?

Kyklas

(Last edited by Kyklas on 3 Oct 2013, 21:30)

My device is GlobeSurferIII+ so no LCD on it.

I open the device to reach the serial pin but found a pretty sleek board not much on the top except shielding with is normal with WiFi + 3G.

The only pins i found were underneath the board i have a row of 4 and a row of 12 pads.

I am not able to see you picture in post 9, could you describe ?

Kyklas

Thanks for the picture. Mine is there : http://postimg.org/image/9ew81ktyj/


Decompressing...............done


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Nov 29 12:13:57 CET 2010 (jan@raptor)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

HW REV: 84
Initializing Arena
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.150.10.24
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes

Total memory used by CFE:  0x80700000 - 0x807C3AF0 (801520)
Initialized Data:          0x80730BD0 - 0x8075D2C0 (182000)
BSS Area:                  0x8075D2C0 - 0x8075DAF0 (2096)
Local Heap:                0x8075DAF0 - 0x807C1AF0 (409600)
Stack Area:                0x807C1AF0 - 0x807C3AF0 (8192)
Text (code) segment:       0x80700000 - 0x80730BD0 (199632)
Boot area (physical):      0x007C4000 - 0x00804000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-0C-E3-73-54-8C, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C
CFE> ^C
CFE> help
Available commands:

et                  Broadcom Ethernet utility.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
autoboot            Automatic system bootstrap.
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
ver                 Print the version.
flash_layout        Show the flash layout.
dump_part           dump a region of a partition to console.
dump                dump a region of memory to console.
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE>

I tried to backup my flash but the device reboot/hangs

CFE> dump 40000 1024
Decompressing...............done

i used the 80000000 addresses and up to download stuff but i'm not sure this is the flash.

How have you done it.

(Last edited by Kyklas on 8 Oct 2013, 21:23)

Hey anarchy99,

Can you tell me if i used the correct flash addresses ?

Tkanks,
Kyklas

anarchy99 wrote:

yeah it reboots if you try to dump, need to use save command and have a running tftp server

save bc000000 02000000, something like that just check if the syntax is correct by running help save command

the above saves complete flash image and you should end up with 33554432 bytes large file. bc replaces first two zeroes to avoid restart

Thanks for the info, i look online the reason for the difference of address and understood the system space vs user space reason ( MIPS processor info ).

I manage to save the flash to a file by tftp. I tried flashing with the image but i got something weird. I flashed with GS CLI flash load -u ... at 0x00040000 and only section 1 was written, section 2 untouched despite that section 1 is smaller than the image size. The system rebooted with the globesurfer system in a reset state, back to admin login and password.

When looking at CFE, the boot data is at : Boot area (physical):      0x007C4000 - 0x00804000

Do you have the same values for boot area ? I'll add later the exact info of CFE booting openrg.

Well, GlobeSurfer3+ is running openwrt, finally !

I need to go around what is there and what's not. I may build another image without some features.

I yet need to try the 3G, does anyone has any info on that ? Quickly i found that the Option chip is based on MDM6200 with could have some support !

Losing my patience with the modem. I don't seems to see the modem with lsusb. I have all mod necessary present for it to work.

I went back to GS to see what i could find and got that the modem can be disable ( usb disconnected )

modem> power 0

Param = 0
Disable power to cobra.
Returned 0
modem> usb.c: USB disconnect on device 00:03.1-1.1 address 3

modem> power 1

Param = 1
Enable power to cobra.
Returned 0
modem> hub.c: new USB device 00:03.1-1.1, assigned address 4
Manufacturer: Option N.V.
Product: Globetrotter HSUPA Modem
HSO: Found Diagnostic port /dev/ttyHS0
HSO: Found Application port /dev/ttyHS1
HSO: Found Control port /dev/ttyHS2
HSO: Found Network port eth1
HSO: Found Modem port /dev/ttyHS3

I looked at the gpio info present on pcekspert post, the gpio 4,5 and 7 are allready set as presented.

Don't know where to look for solution !