Option Globesurfer III

20150402: What is the target? What is the name of the image? I don't find GlobeSurfer3 among Barrier Breaker images. Also 12.09.1 was listed in Table of Hardware as version? That sounds wrong - was it supported for AA? Please clearify. /Zo0ok

Globesurfer III is a wireless router with 3G modem and RJ11 port for analog phone by default.

It was replaced by Globesurfer III+ after some time. Main differences are faster 3G card (GTM661W) and removal of LCD, the rest is same.

GlobeSurfer III is not officially supported by OpenWRT. See Forum.

GlobeSurfer III specifications are more details on WikiDevi

Globesurfer III

http://s96.photobucket.com/user/m111920/media/Globesurfer/option-globesurfer-iii-3g-router_zpsh9vtlbzu.jpg

Globesurfer III+

http://i96.photobucket.com/albums/l166/m111920/Globesurfer/GSIII_zps5q5w6bqf.jpg

SIM card slot:

http://i96.photobucket.com/albums/l166/m111920/Globesurfer/option_globesurfer_iii_3_zpsifacepgz.jpg

Connectors:

http://i96.photobucket.com/albums/l166/m111920/Globesurfer/381683_e60423dc-62d0-11e0-a5cc-e880896bfc68_zpsb7g6lzy1.jpg

Inside(GS3):

http://i96.photobucket.com/albums/l166/m111920/Globesurfer/1mediump_zpsco6rbaiu.jpg

http://i96.photobucket.com/albums/l166/m111920/Globesurfer/2mediuma_zpspazi0b5r.jpg

Router provides separate RX and TX antennas and it gives very good Wifi signal quality, transmit power can be set 24dBm (251mW) as highest, it has internal Wifi signal amplifier.

3G performance is also very good thanks to two big antennas in upper corners.

The serial port and JTAG pads are on the pcb. Remove the 4 Torx 10 screws and lift the cover.

Serial and JTAG Pad

See the forum for more info : JTAG Post

Please read the article flash.layout for a better understanding.

The factory firmware is composed of multiple sections

• Section 00 : CFE Bootloader
• Section 01 : First bootable image
• Section 02 : Second bootable image ( recovery )
• Section 03
• Section 04 : OpenRG Configuration
• Section 05 : OpenRG Configuration
• Section 06 : OpenRG Factory Configuration
• Section 07
• Section 08 : NVRAM

CFE> flash_layout
Flash layout:

Section 00 Type UNKNOWN    Range 0x00000000-0x00040000 MaxSize 0x00040000
        No more information.

Section 01 Type IMAGE      Range 0x00040000-0x00840000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Tue Dec 31 19:07:03 2002'
        Checksum 0x3F5C2EEA Counter 0x00000113 Start Offset 0x00000000

Section 02 Type IMAGE      Range 0x00840000-0x01040000 MaxSize 0x007FFF6C
        Size 0x007D6000 Name 'Downloaded at: Tue Dec 31 19:11:23 2002'
        Checksum 0x3F5903FC Counter 0x0000010E Start Offset 0x00000000

Section 03 Type UNKNOWN    Range 0x01040000-0x01FA0000 MaxSize 0x00F5FF6C
        Size 0x0079AD4E Name 'Downloaded at: Tue Dec 31 19:07:03 2002'
        Checksum 0x3C97916A Counter 0x00000112 Start Offset 0x00000000

Section 04 Type CONF       Range 0x01FA0000-0x01FC0000 MaxSize 0x0001FF6C
        Size 0x00004593 Name 'rg_conf'
        Checksum 0x0022E78C Counter 0x00000139 Start Offset 0x00000000

Section 05 Type CONF       Range 0x01FC0000-0x01FE0000 MaxSize 0x0001FF6C
        Size 0x00004590 Name 'rg_conf'
        Checksum 0x00231B6A Counter 0x0000013B Start Offset 0x00000000

Section 06 Type FACTORY    Range 0x01FE0000-0x01FF0000 MaxSize 0x0000FF6C
        Size 0x00001152 Name 'rg_factory'
        Checksum 0x00049B12 Counter 0x00000118 Start Offset 0x00000000

Section 07 Type UNKNOWN    Range 0x01FF0000-0x01FF8000 MaxSize 0x00008000
        No more information.

Section 08 Type UNKNOWN    Range 0x01FF8000-0x02000000 MaxSize 0x00008000
        No more information.

Total 9 sections found.
*** command status = 0

1. Download the image Supported Version and move it to TFTP folder (use program called TFTPD32 for flashing from windows (TFTPD64 if your system is 64bit)
2. Set your PC's card to 192.168.1.2 and subnet 255.255.255.0, plug the ethernet cable to the second port on router, the one next to antenna connector
3. Start TFTP server
4. Connect with telnet to 192.168.1.1 (with PuTTY)
5. Flash the image with command

    flash load -u tftp://192.168.1.2/openwrt-GlobeSurfer3-squashfs.bin -r 0x00040000 

6. After uploading image, you should restart the router with simple command

   system reboot

7. After a few minutes it should boot with openwrt image

Note: This router have two boot sections (we flashed the first one), so if your router won't start openwrt at this point, you should flash openwrt image to second section with this command:

flash load -u tftp://192.168.1.2/openwrt-GlobeSurfer3-squashfs.bin -r 0x00840000

This image contains drivers for USB, WLAN, 3G card and everything works very stable.

Done

Note : CFE bootloader is accessible via the serial pad.
The serial configuration is 115200 with 8-bits data, no parity, 1-bit stop.

The bootloader process can be interrupted with Ctrl+C combination.

The device can boot an initramfs image. This is a quick way to test the system before flashing.
The procedure for booting a such image is described at BCM47XX CFE

ifconfig eth0 -addr=192.168.2.2

ifconfig eth0 -auto

boot -elf 192.168.2.1:/vmlinux.elf

The flash layout of the device can be printed to the console :

CFE> flash_layout

Note : Do not erase or flash the bootloader, i.e Section 00, unless you know what you are doing.

Prior flashing, the flash can be saved via tftp. For saving, the flash start address is 0xbc000000. The following command saves the whole 32MiB of flash.

save 192.168.2.1:/flash.bin bc000000 2000000

To flash an image onto the device. Section 01 has to be re-written with the new image. Section 02 may need to be erased if the image is too small. CFE may boot to the secondary OpenRG image on the device if present.

flash -offset=0x00040000 -noheader 192.168.2.1:/openwrt-brcm47xx-legacy-gs3-squashfs.bin flash0

There is no need to install additional drivers for Option 3G card.

This card works as HSO device, so it's not yet configurable via LuCI, you must edit network file instead:

etc/config/network 

it should look like this:

config interface 'option'
	option proto 'hso'
	option ifname 'hso0'
	option device '/dev/ttyHS3'
	option service 'umts'
	option apn 'your_apn'
	option pincode 'your pin'

then assign new interface to firewall zone WAN

After pressing connect, wait about 30 secounds and you are good to go, log should look like this:

OpenWrt daemon.notice netifd: option (15351): SIM ready
OpenWrt daemon.notice netifd: option (15351): PIN set successfully
OpenWrt daemon.notice netifd: option (15351): ATZFeb 26 13:14:34 OpenWrt daemon.notice netifd: option (15351): OKCalling UMTS/GPRS^M
OpenWrt daemon.notice netifd: option (15351): AT+CGDCONT=1,"IP","data.vip.hr"
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OPSYS=3,2
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OWANCALL=1,1,0
OpenWrt daemon.notice netifd: option (15351): OK
OpenWrt daemon.notice netifd: option (15351): AT_OWANDATA=1
OpenWrt daemon.notice netifd: option (15351): _OWANDATA: 1, 10.79.22.240, 0.0.0.0, 212.91.97.4, 212.91.97.3, 0.0.0.0, 0.0.0.0, 72000
OpenWrt daemon.notice netifd: Interface 'option' is now up

Notes

• be aware that modem must be unlocked to your operator
• if you swap the SIM card while router is on, you must restart it because the card hotplug doesn't work without extra commands I don't know now
• usb_modeswitch will try to switch device but it fails, you can delete this file to prevent this:

/etc/usb_modeswitch.d/0af0:7601

The CFE bootloader will boot an image in a specific format. An OpenRG section needs to have a OpenRG Header. The OpenRG header is followed by a TRX header containing the bootable firmware. CFE checks the OpenRG checksum and the TRX CRC32.

The OpenRG header checksum is the sum of all bytes in header + data. The checksum is done with the OpenRG Checksum bytes being zero. The amount of data is set in length. The OpenRG checksum and length value are stored in Big-Endian. The TRX header part offsets are relative to the start of the TRX header. The TRX CRC32 and length value are stored in Little-Endian.

OpenRG image header hexdump

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00040000  FE ED BA BE 00 7D 60 00 3F 5C 2E EA 00 00 01 13  þíº¾.}`.?\.ê....
00040010  00 00 00 00 44 6F 77 6E 6C 6F 61 64 65 64 20 61  ....Downloaded a
00040020  74 3A 20 54 75 65 20 44 65 63 20 33 31 20 31 39  t: Tue Dec 31 19
00040030  3A 30 37 3A 30 33 20 32 30 30 32 00 00 00 00 00  :07:03 2002.....
*
00040090  00 00 00 00 48 44 52 30 00 60 7D 00 8A 9E 18 B5  ....HDR0.`}.Šž.µ
000400A0  00 00 01 00 1C 00 00 00 00 00 00 00 00 00 00 00  ................
000400B0  1F 8B 08 08 36 F6 C3 4D 02 03 6A 6D 70 5F 62 6F  .‹..6öÃM..jmp_bo

OpenWRT firmware image hexdump.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  FE ED BA BE 00 3F FF 6C 1F B3 F5 62 00 00 00 00  þíº¾.?ÿl.³õb....
00000010  00 00 00 00 4F 70 65 6E 52 47 20 4F 70 65 6E 57  ....OpenRG OpenW
00000020  52 54 20 31 35 2E 30 35 20 43 43 00 00 00 00 00  RT 15.05 CC.....
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
*
00000090  00 00 00 00 48 44 52 30 6C FF 3F 00 0D C6 A2 1F  ....HDR0lÿ?..Æ¢.
000000A0  00 00 01 00 1C 00 00 00 38 09 00 00 6C 13 11 00  ........8...l...
000000B0  1F 8B 08 00 00 00 00 00 02 03 8D 57 51 68 1C D7  .‹.........WQh.×

How to add tags