I was playing around with the same thoughts about having a rescue mode for myself a couple days ago and got it worked it out.
Is that a killhdinitrd'd 3.1.5 kernel you've got partition 3? I don't think it is because I don't think your Tivo thinks so.
When you are giving it boot -3 it appears to first verify the signature on the kernel its failing right there for you. If that check passes its going to boot using the boot parameters in the boot sector and kernel on partition 3. If your kernel was passing the check what it would do is boot the kernel in partition 3 and mount the root from /dev/hda7 (I'm sure hda7 is your current root since hda6 is your current primary boot partition.) That wouldn't be what you want either (at least I wouldn't guess thats you want, not a mind reader).
I really think that kernel you've got there on partition 3 is not what you think it is. Get yourself a good killhdinitrd'd kernel there on 3 and then in the prom make sure to specify the root and serial console boot parameters manually yourself, if you do that it won't use the ones in the boot sector. So in your case you'll need (assuming serial port 2 is your console)
boot -3 "root=/dev/hda4 upgradesoftware=false dsscon=true console=2,115200"
Now what I've done is on the alternate pair I've got a killed 3.1.5 kernel and an /etc/rc.d/rc.sysinit that just starts up a bash shell. Partition 3 is currently my alternate boot and I can boot to it just fine with boot -3 "root=/dev/hda4 upgradesoftware=false dsscon=true console=2,115200"
On my active pair I've again got a killed 3.1.5 kernel and an /etc/rc.d/rc.sysinit the first 12 lines of which are..
echo here we go
if [ $bash ]
/hack/setsid /bin/bash --login < /dev/ttyS2 &> /dev/ttyS2
Here's the deal, this is cool, if I ever get in a jam or once I've accepted a software upgrade from Tivo, then all I've got to do is boot from the prom menu and specify bash=something as a boot parameter and I end up in a bash shell where I can fix the problem or copy all my hacks over to the newly upgraded pair. When you are in the prom you can type param to see your current boot parameters. Here's my set up in action, booting from the prom menu with bash=true as a boot parameter.. if I'd left off the bash=true parameter or just typed boot -6 or even just boot or even just not gone into the prom menu at all it would have booted up completely..
Ram size = 32
Service number is 240000080631B82.
What is password? factory
Build target = TiVo p0
Build version = 1.18
boot - [ -skip ] [ -3 | -6 ] [ <boot string> ]
netboot - [ -skip ] [ -f <file> ] [ <boot string> ]
param - [ <new boot args> ]
Current boot page:
signature = 0x1492
primaryBootPartition = 6
alternateBootPartition = 3
bootParams = "root=/dev/hda7 upgradesoftware=false dsscon=true
netBootName = ""
What? boot -6 "root=/dev/hda7 upgradesoftware=false dsscon=true console=2,115200
Attempting to disk load partition 6
Kernel signed by 'Kernel release key'
Hashing kernel... done
Checking signature... done.
Signed, valid for release
CPU revision is: 00005430
FPU revision is: 00005410
Primary instruction cache 32kb, linesize 32 bytes.
Primary data cache 32kb, linesize 32 bytes.
Linux version 2.4.20 (build@buildmaster5) (gcc version 3.0) #22 Fri Feb 20 18:19
:25 PST 2004
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda7 upgradesoftware=false dsscon=true console=2,
Monotonic time calibrated: 81.00 counts per usec
Calibrating delay loop... 161.79 BogoMIPS
Contiguous region 1: 1048576 bytes @ address 0x81780000
Contiguous region 2: 524288 bytes @ address 0x81880000
Contiguous region 8: 7340032 bytes @ address 0x81900000
Contiguous region of 8912896 bytes total reserved at 0x81780000.
Memory: 22156k/32768k available (1222k kernel code, 10612k reserved, 81k data, 6
4k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
ttyS00 at iomem 0xb4100100 (irq = 79) is a 16550A
ttyS00 at port 0xbc010000 (irq = 133) is a unknown
ttyS00 at iomem 0xb4100140 (irq = 81) is a 16550A
ttyS00 at iomem 0xb4100120 (irq = 80) is a 16550A
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
ttyS00 at 0xb4100100 (irq = 79) is a 16550A
ttyS01 at 0xbc010000 (irq = 133) is a unknown
ttyS02 at 0xb4100140 (irq = 81) is a 16550A
ttyS03 at 0xb4100120 (irq = 80) is a 16550A
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
hda: SAMSUNG SV1204H, ATA DISK drive
hdb: Maxtor 4R080L0, ATA DISK drive
ide0 at 0x400-0x407,0x438 on irq 87
hda: 234493056 sectors (120060 MB) w/2048KiB Cache, CHS=232632/16/63
hdb: 160086528 sectors (81964 MB) w/2048KiB Cache, CHS=9964/255/63
hda: [mac] hda1 hda2 hda3 hda4 hda5 hda6 hda7 hda8 hda9 hda10 hda11 hda12 hda13
hda14 hda15 hda16
hdb: [mac] hdb1 hdb2 hdb3 hdb4
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
ip_conntrack version 2.1 (256 buckets, 2048 max) - 152 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
VFS: Mounted root (ext2 filesystem) readonly.
Freeing unused kernel memory: 64k freed
here we go
One final note, root will be mounted read only. When you mount or remount any file system Linux tries to update the /etc/mtab file which is basically just a list of the mounted file systems. But it won't be able to do because root is mounted read only and /var which is where the /etc/mtab symbolic link actually points to isn't even mounted at all. Basically your going to just need to specify -n on any mount commands until you've got /var mounted rw, for example mount -n -o rw /dev/hda9 /var
or maybe a
mount -n -o rw,remount /dev/hda7 /
And a final, final note :-), I see everybody on here doing stty sane on their consoles, I've found that to really be of no use, at least on my Tivo. However, what is HIGHLY useful is
stty rows 24 columns 80
Issue that command right away in the bash prompt on your serial console (in fact I've got it in my .bash_profile), have TERM set to xterm and then you should be able to edit files and do anything that makes use of the full terminal window without issue.