recovery with bad flash config

I have tried to manipulate the flash and created and deleted and changed the microcode, 

wrote an old bad Fis Directory backup to the fis directory and screwed all up.

there were some partitions with  

@a`Bocd a         0x00000000  0x00000000  0x00020000  0x00000000
BA@               0x503C0000  0x503C0000  0x00020000  0x00000000 

and no Redboot Config partition  but a 'BA@' partition

I wasnt able to delete the "@a`Bocd a" partition with 'fis delete' 

:(

First it is important that the first partition is not touched. NEVER touch the RedBoot Partition itself. 

I have read the log from a good recovery process once more, and there i've found this:

RedBoot> load -r -v -b 0x700000 zImage-recovery
Using default protocol (TFTP)
|#/#-#\#|#

//some more lines with raw data transfer
-#\#|#-###|#/#
Raw file loaded 0x00700000-0x00a7ebb3, assumed entry at 0x00700000
RedBoot> go 

Uncompressing Linux......................................................... done, booting the kernel.
Linux version 2.4.27-uc1 (root@LAWILINUX) (gcc version 3.3.2) #1050 Mon Jan 23 15:44:47 CET 2006 

and

Creating 5 MTD partitions on "IXP425 Flash":
0x00000000-0x00040000 : "RedBoot"
0x00080000-0x00200000 : "kern1"
0x00200000-0x00380000 : "kern2"
0x003c0000-0x003e0000 : "RedBoot config"
0x003e0000-0x00400000 : "FIS directory" 

 
so i found the RedBoot User Guide with all commands
http://ecos.sourceware.org/docs-latest/ ... guide.html
and especially the the fis commands 
http://ecos.sourceware.org/docs-latest/ ... mmand.html 

you will need to access to the console from RedBoot and Linux with the Serial UART Con401

here is a full HowTo 

http://cavebeat.blogspot.com/2012/01/fsg-3-serial-mod.html

so i tried to boot the FSG-3 with RESET/EMERGENCY Button pressed, then it takes a few seconds 
and it starts up with network settings 

I used the load command

and booted the recovery linux wich recovers the fsg. but there appeared some problems because of the 

bad flash images

so i found the 

http://ecos.sourceware.org/docs-latest/redboot/redboot-guide.html

and the fis commands

http://ecos.sourceware.org/docs-latest/redboot/fis-init-command.html

This command is used to initialize the Flash Image System (FIS). It should normally only be executed once, when RedBoot is first installed on the hardware. If the reserved images or their sizes in the FIS change, due to a different configuration of RedBoot being used, it may be necessary to issue the command again though.

 so i initialized the fis with this command and started again the fsg with emergency button and loaded the recovery image and repaired my fsg-3

Now it is booting with the Freecom Firmware 4.2.7

:) 

so i'm not afraid to change something in the flash layout, add partition for microcode and openWRT purposes.

Here is the complete log.file from the fis init command and recovery
 

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.01.23 20:10:25 =~=~=~=~=~=~=~=~=~=~=~=
###�#+FLASH configuration checksum error or invalid key
Ethernet eth0: MAC address 00:00:83:20:50:02
IP: 192.168.1.3/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 1.94 - built 11:47:48, Jun 10 2005

Platform: Freecom Storage  Gateway (FSG) (XScale) BE
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

RAM: 0x00000000-0x04000000, 0x0001db58-0x03fd0000 available
FLASH: 0x50000000 - 0x50400000, 32 blocks of 0x00020000 bytes each.
FREECOM ermergency button pressed!
== Executing boot script in 0.000 seconds - enter ^C to abort

RedBoot>
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00040000  0x00000000
kern1             0x50080000  0x00700000  0x00180000  0x00700000
kern2             0x50200000  0x00700000  0x00180000  0x00700000
@a`Bocd a         0x00000000  0x00000000  0x00020000  0x00000000
BA@               0x503C0000  0x503C0000  0x00020000  0x00000000
FIS directory     0x503E0000  0x503E0000  0x00020000  0x00000000
RedBoot> fis init -f
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0x50040000-0x503c0000: ............................
... Erase from 0x503e0000-0x503e0000: 
... Erase from 0x50400000-0x50400000: 
... Unlock from 0x503e0000-0x50400000: .
... Erase from 0x503e0000-0x50400000: .
... Program from 0x03fdf000-0x03fff000 at 0x503e0000: .
... Lock from 0x503e0000-0x50400000: .
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00040000  0x00000000
kern1             0x50080000  0x00700000  0x00180000  0x00700000
kern2             0x50200000  0x00700000  0x00180000  0x00700000
RedBoot config    0x503C0000  0x503C0000  0x00020000  0x00000000
FIS directory     0x503E0000  0x503E0000  0x00020000  0x00000000
RedBoot> load -r -v -b 0x700000 zImage-recovery
Using default protocol (TFTP)
|#/#-#\#|#//some more lines with data transfer
-#\#|#-###|#/#
Raw file loaded 0x00700000-0x00a7ebb3, assumed entry at 0x00700000
RedBoot> go
Uncompressing Linux......................................................... done, booting the kernel.
Linux version 2.4.27-uc1 (root@LAWILINUX) (gcc version 3.3.2) #1050 Mon Jan 23 15:44:47 CET 2006
CPU: XScale-IXP4xx/IXC11xx revision 1
Machine: Intel IXP425 Freecom Platform
Warning: bad configuration page, trying to continue
alloc_bootmem_low
memtable_init
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/ram0 initrd=0x00800000,8M mem=64M@0x00000000
Calibrating delay loop... 266.24 BogoMIPS
Memory: 64MB = 64MB total
Memory: 54736KB available (1528K code, 276K data, 60K init)
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: reset bus...
PCI Autoconfig: Found Bus 0, Device 12, Function 0
PCI Autoconfig: BAR 0, I/O, size=0x10, address=0xfffffff0
PCI Autoconfig: BAR 1, I/O, size=0x10, address=0xffffffe0
PCI Autoconfig: BAR 2, I/O, size=0x10, address=0xffffffd0
PCI Autoconfig: BAR 3, I/O, size=0x10, address=0xffffffc0
PCI Autoconfig: BAR 4, I/O, size=0x20, address=0xffffffa0
PCI Autoconfig: BAR 5, I/O, size=0x100, address=0xfffffe00
PCI Autoconfig: Found Bus 0, Device 14, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x1000, address=0x4bfff000
PCI Autoconfig: Found Bus 0, Device 14, Function 1
PCI Autoconfig: BAR 0, Mem, size=0x1000, address=0x4bffe000
PCI Autoconfig: Found Bus 0, Device 14, Function 2
PCI Autoconfig: BAR 0, Mem, size=0x100, address=0x4bffdf00
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
kinoded started
VFS: Disk quotas vdquot_6.5.1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff000003 (irq = 15) is a XScale UART
ttyS01 at 0xff001003 (irq = 13) is a XScale UART
ledman: Copyright (C) SnapGear, 2000-2003.
LEDMAN: registered RESET switch on IRQ26
LEDMAN: registered UNPLUG switch on IRQ27
LEDMAN: registered SYNC switch on IRQ21
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VIA_6421: IDE controller at PCI slot 00:0c.0
VIA_6421: chipset revision 80
VIA_6421: 100% native mode on irq 22
    ide0: BM-DMA at 0xffb0-0xffb7, BIOS settings: hda:pio, hdb:pio
SATA stat after reset 0
    ide1: BM-DMA at 0xffa0-0xffa7, BIOS settings: hdc:pio, hdd:pio
SATA stat after reset 0
    ide2: BM-DMA at 0xffa8-0xffaf, BIOS settings: hde:pio, hdf:pio
hda: Hitachi HDT725050VLAT80 T7, ATA DISK drive
blk: queue c01d59e8, no I/O memory limit
ide0 at 0xffd0-0xffd7,0xffda on irq 22
hda: attached ide-disk driver.
hda: host protected area => 1
hda: 976773168 sectors (500108 MB) w/7372KiB Cache, CHS=60801/255/63, UDMA(33)
Partition check:
 hda: hda1 hda2 hda3 hda4
cfi_cmdset_0001: Erase suspend on write enabled
Using buffer write method
Creating 5 MTD partitions on "IXP425 Flash":
0x00000000-0x00040000 : "RedBoot"
0x00080000-0x00200000 : "kern1"
0x00200000-0x00380000 : "kern2"
0x003c0000-0x003e0000 : "RedBoot config"
0x003e0000-0x00400000 : "FIS directory"
CFI: Found no IXP425 Flash device at location zero
i2c-core.o: i2c core module version 2.9.0 (20041228)
i2c-dev.o: i2c /dev entries driver module version 2.9.0 (20041228)
IXP425 Montejade I2C support available
i2c-proc.o version 2.9.0 (20041228)
isl1208.o: version 2.9.2-Freecom (20051016) with RTC device support
eeprom.o version 2.9.0 (20041228)
w83781d.o version 2.9.2-Freecom (20051016)
i2c-algo-bit.o: IXP425 I2C Adapter sendbytes: error - bailout.
w83781d.o:  PWM-Divisor 60; must be 0-4
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
Linux IP multicast router 0.06 plus PIM-SM
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.97 (double precision)
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 8192K
VFS: Mounted root (ext2 filesystem) readonly.
Freeing init memory: 60K
FSG Recovery System started
Starting network.
Using /lib/modules/2.4.27-uc1/kernel/ixp425/ixp400/ixp400.o
Module init.Using /lib/modules/2.4.27-uc1/kernel/ixp425/net/ixp425_eth.o
<6>ixp425_eth: 
Initializing IXP425 NPE Ethernet driver software v. 1.1+ 
ixp425_eth: CPU clock speed (approx) = 0 MHz
ixp425_eth: eth0 is using the PHY at address 5
ixp425_eth: eth1 is using the PHY at address 4 
FSG Recover 1.1.7 
MyIP=192.168.1.3 HostIP=192.168.1.2 BroadcastAddr=192.168.3.255 SubnetmaskIP=255.255.252.0
ifconfig eth0 192.168.1.3 broadcast=192.168.3.255 netmask=255.255.252.0 up
reiserfs: found format "3.6" with standard journal
reiserfs: using ordered data mode
reiserfs: checking transaction log (device ide0(3,4)) ...
for (ide0(3,4))
reiserfs: replayed 7 transactions in 0 seconds
ide0(3,4):Using r5 hash to sort names
mkreiserfs 3.6.19 (2003 www.namesys.com)
mkreiserfs 3.6.19 (2003 www.namesys.com)
reiserfs: found format "3.6" with standard journal
reiserfs: using ordered data mode
reiserfs: checking transaction log (device ide0(3,1)) ...
for (ide0(3,1))
ide0(3,1):Using r5 hash to sort names
reiserfs: found format "3.6" with standard journal
reiserfs: using ordered data mode
reiserfs: checking transaction log (device ide0(3,2)) ...
for (ide0(3,2))
ide0(3,2):Using r5 hash to sort names
tftp: timeout
umount: /dev/hda2: Device or resource busy
1+0 records in
1+0 records out
reiserfsck 3.6.19 (2003 www.namesys.com)

*************************************************************
** If you are using the latest reiserfsprogs and  it fails **
** please  email bug reports to reiserfs-list@namesys.com, **
** providing  as  much  information  as  possible --  your **
** hardware,  kernel,  patches,  settings,  all reiserfsck **
** messages  (including version),  the reiserfsck logfile, **
** check  the  syslog file  for  any  related information. **
** If you would like advice on using this program, support **
** is available  for $25 at  www.namesys.com/support.html. **
*************************************************************

Will check consistency of the filesystem on /dev/hda4
and will fix what can be fixed without --rebuild-tree
Will put log info to 'stdout'
###########
reiserfsck --fix-fixable started at Thu Jan  1 00:02:34 1970
###########
Replaying journal..
Reiserfs journal '/dev/hda4' in blocks [18..8211]: 0 transactions replayed 

After That, i rebooted it, and it comes up with standard configuration from Freecom Firmware 4.2.7 from FSGA 1.7

The home partition /dev/sda4 (/dev/hda4) is not touched. 

happy de-bricking