Hi,
I tried to flashed this firmware : https://downloads.lede-project.org/snapshots/targets/brcm47xx/mips74k/lede-brcm47xx-mips74k-netgear-wnr3500l-v2-squashfs.chk
But unfortunately, the router does not want now to reboot 
Any idea on what happened and what can I do to recover it ?
Thanks !
Ok, I could unbrick it after opening, plugging USB/UART, and running tftp. After pushing the Netgear factory, I could verify that it works.
With this same setup, if I push the above image, it seems that this is not accepted by tftpd : after receiving the image, the board does not reboot, and the flash is not modified, and the board still boots on Netgear firmware.
Does anyone runs WNR3500L v2 under LEDE firmware ? Which image should I take ?
Thanks !
Try using the update functionality in the Netgear firmware to apply the image. Don't use tftp to put the LEDE firmware.
Hi,
Thanks for your help.
Unfortunately, this did not change anything, I'm still having the exact same failure.
CFE for WNR3500Lv2 version: v1.0.9
Build Date: Fri May 6 11:54:17 CST 2011
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
CPU type 0x19749: 480MHz
Tot mem: 131072 KBytes
Device eth0: hwaddr E8-FC-AF-7B-45-9E, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Checking crc...done.
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3848 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
And nothing more, the device is stuck here. I also tried to git clone, then compile myself a version, exact same issue.
I would be happy to help on debugging this and providing a patch, but I must be coached for this 
Up.
Can anyone confirm please that it is expected to boot on WNR3500L ?
Up.
Does anyone can confirm that images are booting on WNR3500L v2 ?
Thanks !
I can confirm that the WNR3500Lv2 does not boot the LEDE release image. I get the same behavior you observed on the serial console, which is also the same behavior one sees from OpenWRT CC. Like you, I'm a noob to LEDE/OpenWRT, but interested in seeing this work. I'm working on getting a 64-bit Linux platform put together to host the tools; that should be ready in a couple of weeks. If you're interested, look into getting a 64-bit Linux platform ready as a preliminary task.
I have an approach in mind to take a look at the Netgear stock firmware and compare that to what LEDE is doing. I hope to see some glaring difference that will be straightforward to fix. Doing more than viewing the stock firmware will require a 32-bit Fedora 6 platform (Netgear built its stock firmware with a set of tools compiled for running on 32-bit targets); I'm hoping to avoid the need for that, but if I decide it's useful or necessary, that will take a bit more time to get going.
Same for me. Wether TFTP nor flashing through netgear firmware seems to work. Any idea where to search?
Just checked the current consumption after the "Starting program at 0x80001000". It doesn't jump around after that point. So I think it is a kinda minor issue.
I have the same problem with my WNR3500Lv2, and I posted about it here:
Same result after flashing LEDE - it loads 3848 bytes, and then hangs instead of booting the kernel.
Same for me.... any version of LEDE...
Exact same issue.
I've tested to flash in tftp, from netgear firmware, and from dd-wrt.
I'm working on it, it seems that standart lzma compression for the kernel, does not work (is not recognized by the CFE).
The bootloader of the board (the CFE), allows to load a kernel from tftp. Using this I could start the kernel
vmlinux-nodictionary.lzma but not vmlinux.lzma (both from lede image builder).
Though I've not been able yet to build an image that starts the kernel at startup, still investigating.
Actually I could build an image where the kernel starts. Unfortunalty the rootfs is not yet found correctly.
The building script;
#!/bin/sh
gcc TRXUtil.c -o TRXUtil
cat 0 > test.bin ;
cat vmlinux-nodictionary.lzma >> test.bin;
cat root.squashfs >> test.bin;
./TRXUtil test.bin;
mv test.bin.trx test.bin;
./TRXUtil test.bin
0 is in hex:
"48 44 52 30 00 D0 E8 00 53 15 C5 FF 00 00 01 00 1C 00 00 00 B4 30 14 00 00 00 00 00"
Uart output:
CFE for WNR3500Lv2 version: v1.0.9
Build Date: Fri May 6 11:54:17 CST 2011
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
CPU type 0x19749: 480MHz
Tot mem: 131072 KBytesDevice eth0: hwaddr B0-7F-B9-9B-90-42, ipaddr 192.168.1.1, mask 255.255.255.0 gateway not set, nameserver not set Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null) Loading: Failed. Could not load 192.168.1.2:vmlinuz: Timeout occured Checking crc...done. Loader:raw Filesys:raw Dev:flash0.os File: Options:(null) Loading: ....... 3726340 bytes read Entry at 0x80001000 Closing network. Starting program at 0x80001000 [ 0.000000] Linux version 4.4.71 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Wed Jun 7 19:24:41 2017 [ 0.000000] CPU0 revision is: 00019749 (MIPS 74Kc) [ 0.000000] bcm47xx: Using bcma bus [ 0.000000] bcma: bus0: Found chip with id 0x5357, rev 0x02 and package 0x0A [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 07fff000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffefff] [ 0.000000] HighMem empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffefff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffefff] [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32511 [ 0.000000] Kernel command line: noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 125912K/131068K available (2976K kernel code, 137K rwdata, 368K rodata, 156K init, 294K bss, 5156K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:128 [ 0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x26, class 0x0) [ 0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1C, class 0x0) [ 0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x03, class 0x0) [ 0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x04, class 0x0) [ 0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x05, class 0x0) [ 0.000000] bcma: bus0: Core 5 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x02, class 0x0) [ 0.000000] bcma: bus0: Core 6 found: I2S (manuf 0x4BF, id 0x834, rev 0x02, class 0x0) [ 0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x0B, class 0x0) [ 0.000000] bcma: bus0: Unsupported ST serial flash (id: 0x0, id2: 0x0) [ 0.000000] bcma: bus0: Early bus registered [ 0.000000] MIPS: machine is Unknown Board [ 0.000000] bcm47xx: Setting up vectored interrupts [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7963585194 ns [ 0.000014] sched_clock: 32 bits at 240MHz, resolution 4ns, wraps every 8947848189ns [ 0.000084] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080) [ 0.070036] pid_max: default: 32768 minimum: 301 [ 0.070277] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.070306] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.074348] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.074401] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.075612] NET: Registered protocol family 16 [ 0.076684] Can't analyze schedule() prologue at 80007788 [ 0.096882] clocksource: Switched to clocksource MIPS [ 0.099121] NET: Registered protocol family 2 [ 0.100821] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.100880] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.100920] TCP: Hash tables configured (established 1024 bind 1024) [ 0.101099] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.101158] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.101625] NET: Registered protocol family 1 [ 0.116791] can not parse nvram name sb/1/boardnum(null) with value 3500L got -22 [ 0.132850] bcma: bus0: Bus registered [ 0.133982] Crashlog allocated RAM at address 0x3f00000 [ 0.164476] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.164509] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.169619] io scheduler noop registered [ 0.169656] io scheduler deadline registered (default) [ 0.170061] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.175046] console [ttyS0] disabled [ 0.195317] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A [ 0.625646] console [ttyS0] enabled [ 0.630746] bcm47xxnflash: Device not supported [ 0.635365] bcm47xxnflash: Initialization failed: -524 [ 0.640721] bcma_nflash: probe of bcma_nflash.0 failed with error -524 [ 0.652739] libphy: Fixed MDIO Bus: probed [ 0.657261] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS) [ 0.665449] libphy: bcma_mdio mii bus: probed [ 0.670019] bgmac_bcma bcma0:2: Support for Roboswitch not implemented [ 0.834837] b53_common: found switch: BCM53115, rev 8 [ 0.841368] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded [ 0.847797] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds) [ 0.857787] NET: Registered protocol family 10 [ 0.869119] NET: Registered protocol family 17 [ 0.873784] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 0.886681] 8021q: 802.1Q VLAN Support v1.8 [ 0.895426] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6 [ 0.903127] Please append a correct "root=" boot option; here are the available partitions: [ 0.911660] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) [ 0.921429] Rebooting in 1 seconds.. [ 1.923383] bcm47xx: Please stand by while rebooting the system...
This image needs to be flashed from dd-wrt.
See this thread for further informations on my tries to have it working, there is a problem with the nand driver:
Same boat. bad firmware in WNR3500L v2. Im just curious why BCM47XX chip compiled in LEDE while DD-WRT same device read as BCM5357 chip?? doesnt seem right...
@devigyn
Check the linux source for that device, it's not uncommon for one driver to support multiple devices. I know that realtek do this.
So whats the final verdict? Is this model supported in LEDE currently or not? Does an old version support it? Why is marked as supported on https://lede-project.org/toh/hwdata/netgear/netgear_wnr3500l_v2 when this thread is apparently ongoing with attempts to fix booting?
Any news on this? I successfully flashed the latest Tomato/AdvancedTomato release on my WNR3500Lv2. Kong's old DD-WRT release http://www.desipro.de/ddwrt/K3-AC-MIPSEL/dd-wrt.v24-K3_WNR3500Lv2.chk is also working. I haven't tried any other build yet. If I try to flash LEDE and it fails to boot, can I recover the router using TFTP or do I need a serial console cable?