Hi i see there is an image for the wrt300n in the 7.07 folder

i would like to give this a try but not sure how to install this or if it has wireless working yet

any ideas any one.

thanks in advance

Hi

I also saw this zImage on kk 7.07 and would like to give it a go.
Is it possible to install through tftp or the web interface?

Thanks in advance

Hi,

I would also like details on how to install this image onto the wrt300n. Has anyone figured this out?

Many Thanks,

Ian

I forgot to mention, the zImage is here:
http://downloads.openwrt.org/kamikaze/7.07/ixp4xx-2.6/

but I'm not sure how you go about installing it.

Some Testresults? I will buy a ne Router and think about the 300N or 350N models. So if you same infos for me let me know, please. What are you thinking about the 350N?

greets,

neon

The WRT300N v2 is an IXP4xx (XScale) based device.  They do not have a standardized image format similar to the trx format for the WRT300N v1 (and other Broadcom based routers.)  You will need both the kernel, openwrt-wrt300nv2-2.6-zImage, and the filesystem, openwrt-ixp4xx-2.6-squashfs.img.  Most of the IXP devices I have run across are running RedBoot as their bootloader, not sure what the WRT300N runs.  Assuming the WRT300N v2 runs RedBoot, flashing consists of several steps:

If all goes well, you now have a working device running OpenWrt.

Whoa, looks like the next generation routers aren't as easy as the WRT54Gs were to upgrade! Though I do find it strange that Linksys is still releasing some sort of bin file to upgrade. I suppose OpenWRT has to do more than what the Linksys upgrades are doing?

Have someone tested the guidance from Bartman007? Does it work?

Hi, I able to create a console cable (using MAX3232) and successfully connected to the console of the WRT300NEU v2.0.17. I downloaded both fs and kernel files (openwrt-wrt300nv2-2.6-zImage & openwrt-ixp4xx-2.6-squashfs.img) and tftp32(to transfer the files to router) then I booted the router and pressed ctrl+c to access redboot console. I wasn't able to run the below commands (by batman007), because the redboot version does not support the load command with %{FREEMEMLO} parameters and also It does not have the fis command with 'create' parameter (but only erease and write). Neon, I think batman007 can help us. Below is boot process output:-

+
RedBoot(tm) bootstrap and debug environment [ROMRAM]
Red Hat certified release, version 2.02 - built 14:59:11, Aug 16 2006

Platform: Intel Generic Residential Gateway (IXP42X 266MHz) BE
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

RAM: 0x00000000-0x01000000, [0x00066480-0x00ff4000] available
FLASH: 0x50000000 - 0x50400000, 64 blocks of 0x00010000 bytes each.
== Executing boot script in 2.000 seconds - enter ^C to abort
RedBoot> boot;exe
eRcOmM signature found
Copying kernel. Size:      11c190
Using base address 0x00400000 and length 0x0011c190
Uncompressing Linux.............................................................................. done, booting the kernel.

Linux version 2.6.13.2 (root@5c10-187-9-1) (gcc version 3.4.3) #1 Thu Oct 12 14:53:29 CST 2006

CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE)

Machine: ADI Engineering Coyote

Memory policy: ECC disabled, Data cache writeback

CPU0: D VIVT undefined 5 cache

CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets

CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets

Built 1 zonelists

Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 noinitrd rootfstype=squashfs mem=16M@0x00000000 init=/sbin/init

PID hash table entries: 128 (order: 7, 2048 bytes)

Console: colour dummy device 80x30

Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)

Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)

Memory: 16MB = 16MB total

Memory: 13316KB available (1686K code, 838K data, 324K init)

Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

NET: Registered protocol family 16

PCI: IXP4xx is host

PCI: IXP4xx Using direct access for memory space

PCI: bus0: Fast back to back transfers enabled

dmabounce: registered device 0000:00:01.0 on pci bus

NetWinder Floating Point Emulator V0.97 (double precision)

Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher

Initializing Cryptographic API

HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096

N_HDLC line discipline registered.

IXP4xx Watchdog Timer: heartbeat 60 sec

Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 2 ports, IRQ sharing disabled

ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale

io scheduler noop registered

PPP generic driver version 2.4.2

PPP Deflate Compression module registered

PPP BSD Compression module registered

NET: Registered protocol family 24

SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).

CSLIP: code copyright 1989 Regents of the University of California.

IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank

Amd/Fujitsu Extended Query Table at 0x0040

number of CFI chips: 1

cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.

Creating 5 MTD partitions on "IXP4XX-Flash.0":

0x00000000-0x00060000 : "boot"

0x00060000-0x003b0000 : "linux"

0x001a0000-0x003b0000 : "rootfs"

0x003f0000-0x00400000 : "nvram"

0x003b0000-0x003f0000 : "lang"

i2c /dev entries driver

u32 classifier

    OLD policer on

NET: Registered protocol family 2

IP route cache hash table entries: 256 (order: -2, 1024 bytes)

/proc/eth1_tm created

TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)

TCP reno registered

ip_conntrack version 2.1 (128 buckets, 1024 max) - 268 bytes per conntrack

ip_conntrack_rtsp v0.6.21 loading

ip_nat_rtsp v0.6.21 loading

ip_tables: (C) 2000-2002 Netfilter core team

netfilter PSD loaded - (c) astaro AG

ipt_random match loaded

ip_conntrack_pptp version 3.0 loaded

ip_nat_pptp version 3.0 loaded

TCP bic registered

NET: Registered protocol family 1

NET: Registered protocol family 17

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (squashfs filesystem) readonly.

Freeing init memory: 324K

init started:  BusyBox v1.1.0 (2006.10.12-05:58+0000) multi-call binary

init started:  BusyBox v1.1.0 (2006.10.12-05:58+0000) multi-call binary

Starting pid 15, console /dev/console: '/etc/rcS'
ixp400: module license 'unspecified' taints kernel.

ixp400_eth: Initializing IXP400 NPE Ethernet driver software v. 1.4A

ixp400_eth: CPU clock speed (approx) = 266 MHz

[warning] Warning: the NPE A component you specified does not exist

ixp400_eth: ixp0 is using NPEB and the PHY at address 16

ixp400_eth: ixp1 is using NPEC and the PHY at address 1

ixp400_eth: Use default MAC address 00:02:b3:01:01:01 for port 0

ixp400_eth: Use default MAC address 00:02:b3:02:02:02 for port 1

rc_init 137
V2.00.17
device eth0 entered promiscuous mode

ap_name=(null),action=start
br0: port 1(eth0) entering learning state

br0: topology change detected, propagating

br0: port 1(eth0) entering forwarding state

start printk...
start wifi
ath0
Interface doesn't accept private ioctl...
maccmd (8BE0): Invalid argument
wlan up!!
start wifi return 0
Configuration file: /tmp/madwifi.conf
start syslog...
syslog_cmd=-R 192.168.1.100:514
Configure bridge br0 for EAPOL traffic.
start httpd...
madwifi_set_iface_flags: dev_up=0
Using interface ath0 with hwaddr 00:18:39:20:e9:7a and ssid 'EIAL-TRAINING'
httpd_cfg.c, load_langpkt(), xchage(header.lang_id)=1, xchage(header.ver)=2000d
madwifi_set_ieee8021x: enabled=1
madwifi_configure_wpa: group key cipher=1
madwifi_configure_wpa: pairwise key ciphers=0xa
madwifi_configure_wpa: key management algorithms=0x2
madwifi_configure_wpa: rsn capabilities=0x0
madwifi_configure_wpa: enable WPA= 0x3
madwifi_set_iface_flags: dev_up=1
madwifi_set_privacy: enabled=1
WPA: group state machine entering state GTK_INIT
GMK - hexdump(len=32): 90 05 df 3d 3f 98 b1 52 9a 8e fd 82 42 20 69 4d d6 2f 6f 88 df 3e 4b 5b c9 27 eb 7c d1 cf a8 9c
GTK - hexdump(len=32): 30 84 fe 45 5c 03 48 24 7f b7 e2 90 c5 38 9e 33 24 b6 9c 2a cc fc f8 e7 74 ae d6 7f 19 3c 02 77
WPA: group state machine entering state SETKEYSDONE
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
Flushing old station entries
Deauthenticate all stations
start dhcpd...
killall: upnpd: no process killed
ap_name=firewall,action=stop
/usr/sbin/fw-scripts/firewall: .: 19: Can't open /tmp/firewall.conf
killall: reaim: no process killed
killall: IGMPProxy: no process killed
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
interface eth0.2 does not exist!
interface eth0.3 does not exist!
interface eth0.4 does not exist!
interface eth0.5 does not exist!
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
ERROR: trying to remove VLAN -:eth0.2:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.3:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.4:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.5:- error: Invalid argument
phy_id=29
return 3
return 3
ap_name=dhcpd,action=create
ap_name=(null),action=restart
/usr/sbin/fw-scripts/firewall: .: 19: Can't open /tmp/firewall.conf
/etc/rcS: /etc/rcS: 91: cannot create /proc/sys/vm/pagetable_cache: Directory nonexistent
killall: reaim: no process killed
/usr/sbin/wizard: waiting for data on port UDP 916
killall: IGMPProxy: no process killed
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
interface eth0.2 does not exist!
interface eth0.3 does not exist!
interface eth0.4 does not exist!
interface eth0.5 does not exist!
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
ERROR: trying to remove VLAN -:eth0.2:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.3:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.4:- error: Invalid argument
ERROR: trying to remove VLAN -:eth0.5:- error: Invalid argument
phy_id=29
return 3
return 3
Starting firewall
Please press Enter to activate this console. iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
proxy:1

Starting pid 435, console /dev/console: '/bin/sh'

BusyBox v1.1.0 (2006.10.12-05:58+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

-sh: can't access tty; job control turned off
~ #

Hi, I'm new to this forum. I'm wondering if there have been any improvment with getting a custom firmware to run on WRT300N v2? I would really like to have a different firmware in my WRT300n v2 router, and be able to do some more advanced network configuration (subnetting etc).

From what I can gather the issue seems to be that no developers have access to the hardware (being US based?) so no firmware is developed. Is this correct? As long as the version used is fairly stable (ie won't brick my router the first thing), I'm willing to do some beta testing.

Thanks for any pointers.

anything new: at least, this is the command to flash the linksys firmware:

 load -r -b 0x70000 -m (choose between 'http' or 'tftp', assuming http, default tftp) http -h 192.168.0.9 (change this to your ip) /wrt300n.bin 
fis write -f 0x50000000 -b 0x70000 -l 0x3fffff

then, type reset and hard reboot your router

ok, if you're using linksys's linuxbb utility from the WRT300N-2.00.20 sources, it is possible to create a bootable OpenWRT image, but it cannot read the partition table and fails booting.BTW does anyone know how to rebuild Linksys's RedBoot??

you need a custom redboot to flash linux, i think. i upload it soon on davidkra.net

woot i got openwrt running, here's the boot log:

Uncompressing Linux................................................................. done, booting the kernel.
Linux version 2.6.21.6 (nbd@ds10) (gcc version 4.1.2) #2 Sun Sep 30 20:44:34 CEST 2007
CPU: XScale-IXP42x Family [690541f1] revision 1 (ARMv5TE), cr=000039ff
Machine: Linksys WRT300N v2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT undefined 5 cache
CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Built 1 zonelists.  Total pages: 4064
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 init=/etc/preinit
PID hash table entries: 64 (order: 6, 256 bytes)
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 16MB = 16MB total
Memory: 14172KB available (1788K code, 167K data, 76K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
PCI: IXP4xx is host
PCI: IXP4xx Using direct access for memory space
PCI: bus0: Fast back to back transfers enabled
dmabounce: registered device 0000:00:01.0 on pci bus
Time: OSTS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
NetWinder Floating Point Emulator V0.97 (double precision)
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
IXP4xx Watchdog Timer: heartbeat 60 sec
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale
IXP4XX Q Manager 0.2.1 initialized.
IXP4XX NPE driver Version 0.3.0 initialized
ixp_crypto: No HW crypto available
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0x3f0000
5 RedBoot partitions found on MTD device IXP4XX-Flash.0
Creating 5 MTD partitions on "IXP4XX-Flash.0":
0x00000000-0x00080000 : "RedBoot"
0x00080000-0x00170000 : "kernel"
0x00170000-0x00290000 : "rootfs"
0x00260000-0x00290000 : "rootfs_data"
0x00290000-0x003f0000 : "unallocated"
0x003f0000-0x00400000 : "FIS directory"
i2c /dev entries driver
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP westwood registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
XScale DSP coprocessor detected.
ixp4xx_mac driver 0.3.1: eth0 on NPE-B with PHY[-1] initialized
ixp4xx_mac driver 0.3.1: eth1 on NPE-C with PHY[1] initialized
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (squashfs filesystem) readonly.
Freeing init memory: 76K
Warning: unable to open an initial console.
- preinit -
jffs2 not ready yet; using ramdisk
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
- init -
init started:  BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) multi-call binary

Please press Enter to activate this console. eth0: NPE-B not running
eth0: NPE-B not running
PPP generic driver version 2.4.2
wlan: 0.8.4.2 (svn r2568)
ath_hal: module license 'Proprietary' taints kernel.
ath_hal: 0.9.30.13 (AR5210, AR5211, AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2133, REGOPS_FUNC)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (svn r2568)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_pci: 0.9.4.5 (svn r2568)
PCI: enabling device 0000:00:01.0 (0340 -> 0342)
irq 25: nobody cared (try booting with the "irqpoll" option)
handlers:
[<bf089258>]
Disabling IRQ #25
MadWifi: unable to attach hardware: 'Hardware didn't respond as expected' (HAL status 3)
jffs2: Too few erase blocks (3)



BusyBox v1.4.2 (2007-09-29 10:12:09 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (7.09) -----------------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#

flashing instructions are at http://wiki.openwrt.org/OpenWrtDocs/Har … ys/WRT300N

Great job with WRT300N v2, David!
I am trying to flash my router to OpenWRT and I need a custom RedBoot. Unfortunately, I have no linux machine at hand. Could you please, public the custom RedBoot binary?
Thank you in advance.

ok
grab it at davidkra.net (http://davidkra.net/downloads2.html)

Thank you for RedBoot binary!
I have a question.
Step 10 in How to install OpenWRT
http://wiki.openwrt.org/OpenWrtDocs/Har … ys/WRT300N

fis write -f 0x50060000 -b 0x70000 -l 0x4d254

But RedBoot image you provided is 4FD00 bytes length.
What length I should use  in the fis command, 0x4FD00 or 0x4d254? Or it just typo in the instruction?

4fd00

Unable to program custom RedBoot.

RedBoot> fis write -f 0x50060000 -b 0x70000 -l 0x4fd00                         
* CAUTION * about to program FLASH                                             
            at 0x50060000..0x500affff from 0x00070000 - continue (y/n)? y      
... Erase from 0x50060000-0x500b0000: .....                                    
RedBoot>

Why fis do not program the flash, only erase?

it programs it
trust me
join #openwrt plz

(Last edited by Davidkra on 24 Mar 2008, 12:41)

Hmm... can it be i typoed the flash addr too? it should be 0x50000000, i think.

Hi Davidkra,

Can you please help me in recovering my WRT300n v2.00.20 as I did somthing wrong and It is no longer booting.

Thanks in advance.

Hi,

I realise this is an old thread, but I hope someone can help.

Here we go..

I have a wrt300n that crashed during a firmware upgrade (.17  --> .21)

I couldn't get a ping response on the default ip 192.168.1.1 or the one I had had it configured to 192.168.30.1

After some reading I came across redboot and the 30/30/30 reset.

I successfully booted into redboot, and tried to install openwrt from these instructions http://nuwiki.openwrt.org/oldwiki/OpenW … ys/WRT300N

Everything seemed to go ok, but then I noticed the section at the bottom referring to recovering a failed linksys firmware update. Should have noticed this earlier.

I followed these new instructions and they worked, I was back into the original 2.00.17 linksys firmware.
However when I tried to reboot the device I got nothing.

After some investigation I discovered that the unit was booting into redboot and not the linksys firmware. I also found that if I let redboot start for more that 10 secs then try to 'telnet 192.168.0.10 9000' and 'ctrl C' 'd a couple of times, it would stop pinging in the redboot ip and start pinging on the linksys one, and I would be able to access the linksys web interface.

What  I'm trying to do is get the unit to automatically boot into the linksys firmware.

If anyone can give me any help with this it would be great.

Thanks

Jim

Hi

I tried to flash my wrt300n v2 following the wiki (Davidkra): http://nuwiki.openwrt.org/oldwiki/OpenW … ys/WRT300N

Redboot was flashed right and images (Backfire 10.03) right too. I think but I can't boot linux kernel.

This is my log on redboot:

----------------------------------------------------------------------------------------------------------
^C
Aborted by user
== Executing boot script in 0.000 seconds - enter ^C to abort
RedBoot> fconfig -l -n
boot_script: true
boot_script_data:

boot_script_timeout: 0
bootp: false
bootp_my_gateway_ip: 0.0.0.0
bootp_my_ip: 192.168.0.10
bootp_my_ip_mask: 255.255.255.0
bootp_server_ip: 192.168.0.2
console_baud_rate: 115200
gdb_port: 9000
info_console_force: false
net_debug: false
net_device: npe_eth0
RedBoot> fconfig boot:script_timeout 2
** entry 'boot:script_timeout' not found
RedBoot> fconfig boot_script_timeout 2
boot_script_timeout: Setting to 2
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0x503f0000-0x50400000: .
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00080000  0x00000000
kernel            0x50080000  0x00070000  0x000F0000  0x00070000
rootfs            0x50170000  0x00070000  0x00120000  0x00070000
FIS directory     0x503F0000  0x503F0000  0x0000F000  0x00000000
RedBoot config    0x503FF000  0x503FF000  0x00001000  0x00000000
RedBoot> fconfig -l -n
boot_script: true
boot_script_data:

boot_script_timeout: 2
bootp: false
bootp_my_gateway_ip: 0.0.0.0
bootp_my_ip: 192.168.0.10
bootp_my_ip_mask: 255.255.255.0
bootp_server_ip: 192.168.0.2
console_baud_rate: 115200
gdb_port: 9000
info_console_force: false
net_debug: false
net_device: npe_eth0
RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0x503f0000-0x50400000: .
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00080000  0x00000000
FIS directory     0x503F0000  0x503F0000  0x0000F000  0x00000000
RedBoot config    0x503FF000  0x503FF000  0x00001000  0x00000000
RedBoot> load -r -b 0x70000 -m tftp openwrt-wrt300nv2-zImage
Raw file loaded 0x00070000-0x00144c77, assumed entry at 0x00070000
RedBoot> fis create kernel
... Erase from 0x50080000-0x50160000: ..............
... Erase from 0x503f0000-0x50400000: .
RedBoot> load -r -b 0x70000 -m tftp openwrt-ixp4xx-squashfs.img
Raw file loaded 0x00070000-0x0022ffff, assumed entry at 0x00070000
RedBoot> fis create rootfs
... Erase from 0x50160000-0x50320000: ............................
... Erase from 0x503f0000-0x50400000: .
RedBoot> fis load kernel
RedBoot> fconfig boot_script_timeout 5
boot_script_timeout: Setting to 5
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0x503f0000-0x50400000: .
RedBoot> ether
RedBoot> fis load kernel
RedBoot> exec

--------------------------------------
It's need to restart router
--------------------------------------
Again on redboot:

^C
RedBoot> boot;exe
** command abort - illegal memory access?
Can't execute Linux - invalid entry address
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00080000  0x00000000
kernel            0x50080000  0x00070000  0x000E0000  0x00070000
rootfs            0x50160000  0x00070000  0x001C0000  0x00070000
FIS directory     0x503F0000  0x503F0000  0x0000F000  0x00000000
RedBoot config    0x503FF000  0x503FF000  0x00001000  0x00000000
RedBoot>

------------------------------------------------

Can anyone help me to load linux kernel?

I don't understand what's wrong!!!

Thanks