Working on WNR3500L v2?

Installing and Using OpenWrt
#7

I can confirm that the WNR3500Lv2 does not boot the LEDE release image. I get the same behavior you observed on the serial console, which is also the same behavior one sees from OpenWRT CC. Like you, I'm a noob to LEDE/OpenWRT, but interested in seeing this work. I'm working on getting a 64-bit Linux platform put together to host the tools; that should be ready in a couple of weeks. If you're interested, look into getting a 64-bit Linux platform ready as a preliminary task.

I have an approach in mind to take a look at the Netgear stock firmware and compare that to what LEDE is doing. I hope to see some glaring difference that will be straightforward to fix. Doing more than viewing the stock firmware will require a 32-bit Fedora 6 platform (Netgear built its stock firmware with a set of tools compiled for running on 32-bit targets); I'm hoping to avoid the need for that, but if I decide it's useful or necessary, that will take a bit more time to get going.

#8

Same for me. Wether TFTP nor flashing through netgear firmware seems to work. Any idea where to search?

#9

Just checked the current consumption after the "Starting program at 0x80001000". It doesn't jump around after that point. So I think it is a kinda minor issue.

#10

I have the same problem with my WNR3500Lv2, and I posted about it here:

Same result after flashing LEDE - it loads 3848 bytes, and then hangs instead of booting the kernel.

#11

Same for me.... any version of LEDE...

#12

Exact same issue.

I've tested to flash in tftp, from netgear firmware, and from dd-wrt.

#13

I'm working on it, it seems that standart lzma compression for the kernel, does not work (is not recognized by the CFE).

The bootloader of the board (the CFE), allows to load a kernel from tftp. Using this I could start the kernel
vmlinux-nodictionary.lzma but not vmlinux.lzma (both from lede image builder).

Though I've not been able yet to build an image that starts the kernel at startup, still investigating.

1 Like
#14

Actually I could build an image where the kernel starts. Unfortunalty the rootfs is not yet found correctly.

The building script;

#!/bin/sh

gcc TRXUtil.c -o TRXUtil
cat 0 > test.bin ;
cat vmlinux-nodictionary.lzma >> test.bin;
cat root.squashfs >> test.bin;
./TRXUtil test.bin;
mv test.bin.trx test.bin;
./TRXUtil test.bin

0 is in hex:
"48 44 52 30 00 D0 E8 00 53 15 C5 FF 00 00 01 00 1C 00 00 00 B4 30 14 00 00 00 00 00"

Uart output:

CFE for WNR3500Lv2 version: v1.0.9
Build Date: Fri May 6 11:54:17 CST 2011
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
NFLASH Boot partition size = 524288(0x80000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.136
CPU type 0x19749: 480MHz
Tot mem: 131072 KBytes

Device eth0:  hwaddr B0-7F-B9-9B-90-42, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinuz: Timeout occured
Checking crc...done.
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 3726340 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 4.4.71 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Wed Jun 7 19:24:41 2017
[    0.000000] CPU0 revision is: 00019749 (MIPS 74Kc)
[    0.000000] bcm47xx: Using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x5357, rev 0x02 and package 0x0A
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 07fff000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffefff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32511
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 125912K/131068K available (2976K kernel code, 137K rwdata, 368K rodata, 156K init, 294K bss, 5156K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x26, class 0x0)
[    0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1C, class 0x0)
[    0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x03, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x04, class 0x0)
[    0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x05, class 0x0)
[    0.000000] bcma: bus0: Core 5 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x02, class 0x0)
[    0.000000] bcma: bus0: Core 6 found: I2S (manuf 0x4BF, id 0x834, rev 0x02, class 0x0)
[    0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x0B, class 0x0)
[    0.000000] bcma: bus0: Unsupported ST serial flash (id: 0x0, id2: 0x0)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Unknown Board
[    0.000000] bcm47xx: Setting up vectored interrupts
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7963585194 ns
[    0.000014] sched_clock: 32 bits at 240MHz, resolution 4ns, wraps every 8947848189ns
[    0.000084] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080)
[    0.070036] pid_max: default: 32768 minimum: 301
[    0.070277] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070306] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.074348] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.074401] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.075612] NET: Registered protocol family 16
[    0.076684] Can't analyze schedule() prologue at 80007788
[    0.096882] clocksource: Switched to clocksource MIPS
[    0.099121] NET: Registered protocol family 2
[    0.100821] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100880] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100920] TCP: Hash tables configured (established 1024 bind 1024)
[    0.101099] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.101158] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.101625] NET: Registered protocol family 1
[    0.116791] can not parse nvram name sb/1/boardnum(null) with value 3500L got -22
[    0.132850] bcma: bus0: Bus registered
[    0.133982] Crashlog allocated RAM at address 0x3f00000
[    0.164476] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.164509] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.169619] io scheduler noop registered
[    0.169656] io scheduler deadline registered (default)
[    0.170061] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.175046] console [ttyS0] disabled
[    0.195317] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[    0.625646] console [ttyS0] enabled
[    0.630746] bcm47xxnflash: Device not supported
[    0.635365] bcm47xxnflash: Initialization failed: -524
[    0.640721] bcma_nflash: probe of bcma_nflash.0 failed with error -524
[    0.652739] libphy: Fixed MDIO Bus: probed
[    0.657261] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[    0.665449] libphy: bcma_mdio mii bus: probed
[    0.670019] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[    0.834837] b53_common: found switch: BCM53115, rev 8
[    0.841368] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[    0.847797] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    0.857787] NET: Registered protocol family 10
[    0.869119] NET: Registered protocol family 17
[    0.873784] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    0.886681] 8021q: 802.1Q VLAN Support v1.8
[    0.895426] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.903127] Please append a correct "root=" boot option; here are the available partitions:
[    0.911660] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.921429] Rebooting in 1 seconds..
[    1.923383] bcm47xx: Please stand by while rebooting the system...

This image needs to be flashed from dd-wrt.

Nand flash driver for bcm47xx wnr3500lv2
Built-in kernel parameters (work on wnr3500lv2)
#15

See this thread for further informations on my tries to have it working, there is a problem with the nand driver:

#16

Same boat. bad firmware in WNR3500L v2. Im just curious why BCM47XX chip compiled in LEDE while DD-WRT same device read as BCM5357 chip?? doesnt seem right...

#17

@devigyn
Check the linux source for that device, it's not uncommon for one driver to support multiple devices. I know that realtek do this.

#18

All devices with BCM53xx have brcm47xx as target, see Table of Hardware

#19

So whats the final verdict? Is this model supported in LEDE currently or not? Does an old version support it? Why is marked as supported on https://lede-project.org/toh/hwdata/netgear/netgear_wnr3500l_v2 when this thread is apparently ongoing with attempts to fix booting?

#20

Any news on this? I successfully flashed the latest Tomato/AdvancedTomato release on my WNR3500Lv2. Kong's old DD-WRT release http://www.desipro.de/ddwrt/K3-AC-MIPSEL/dd-wrt.v24-K3_WNR3500Lv2.chk is also working. I haven't tried any other build yet. If I try to flash LEDE and it fails to boot, can I recover the router using TFTP or do I need a serial console cable?

#21

I had to use the USB-to-serial console in order to interrupt the bootup sequence and manually pull the good firmware over tftp. YMMV!

#22

New beta DD-WRT firmware on official site works too.

#23

@paulmedynski: Thanks. Then I will wait to get my serial console cable before I try to flash LEDE.

@steel_rat: Thank you for the hint! I just flashed https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2017/12-29-2017-r34311/netgear-wnr3500lv2/dd-wrt.v24-34311_NEWD-2_K3.x_mega-WNR3500Lv2.chk and I can confirm that it works. By the way, do you know what's different compared to the smaller image https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2017/12-29-2017-r34311/broadcom_K3X/dd-wrt.v24-34311_NEWD-2_K3.x_mega-WNR3500Lv2.chk?
Altough the router is now useable with DD-WRT I would prefer to have LEDE running :slight_smile:

#24

That question would perfectly fit in the dd-wrt forum :wink:

#25

Confirmed that with the latest snapshot image:
openwrt-brcm47xx-mips74k-netgear-wnr3500l-v2-squashfs.chk
DOES NOT BOOT after flashing, WNR3500L V2.
2018-02-27

So this device is still not working, but claimed to be supported device on the wiki.

Will there be a working OpenWRT image for the WNR3500L V2 ?

#26

Just a quick how to run an openwrt kernel on wnr3500Lv2 with tftp (no breaktrough Nand driver still does not work):

1-Remove packages tftpd xinted and inetd (make sure you don't have any /usr/bin/inetd )
2-Do "fuser 69/udp"
3-Create a folder /srv/tftpd/
4-copy [your_openwrt_src_folder]/build_dir/target-mipsel_74kc_musl/linux-brcm47xx_mips74k/vmlinux-nodictionary.lzma  as /srv/tftpd/vmlinuz
5-Install atftpd
6-Start "atftpd with command  atftpd --daemon --bind-address 192.168.1.2 /srv/tftp/" make sure the process is running in "ps -aux".
7-Connect to your router's lan and take the IP 192.168.1.2
8-Reboot your router, it will automatically fetch the vmlinuz and boot on it.