Upgrade from Lede 17.01 [back] to Openwrt 19.07

I was running scp07's very stable 19.07.7 build for Xiaomi AC2100 for over a year, but got tempted by potentially better WLAN performance from a custom Openwrt build with closed-source MTK drivers posted on another internet forum.

There're two versions of the aforementioned custom build, 1) a regular version to be flashed AFTER first flashing a cryptically referenced "initramfs" firmware, the latter of which I can't find a download link for, 2) a Breed version to be flashed directly onto the "second kernel partition", which I went with since it seemed pretty straightforward.

Long story short, the custom build is not all that, especially in terms of 5GHz range. More over, it's built on a Lede Reboot 17.01 snapshot. So now I'm aching to go back to 19.07.x.

I tried a couple of sysupgrade.bin images, with the sysupgrade -F -n option. Each time, sysupgrade failed:

Switching to ramdisk...
Performing system upgrade...
Could not open mtd device: firmware
Can't open device for writing!
Upgrade completed
Rebooting system...
umount: can't unmount /dev/pts: Resource busy
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
(after long wait)
packet_write_wait: Connection to Broken pipe

Luckily, the router didn't brick and still boots with that 17.01-based build.

So, the question is, how do I upgrade from this 17.01, back to 19.07? The partition layout seems very different from 19.07:

Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs       23.6M     23.6M         0 100% /rom
tmpfs                tmpfs          60.7M    144.0K     60.6M   0% /tmp
/dev/ubi0_1          ubifs          78.8M    816.0K     74.0M   1% /overlay
overlayfs:/overlay   overlay        78.8M    816.0K     74.0M   1% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

And cat /proc/mtd

dev:    size   erasesize  name
mtd0: 00080000 00020000 "Bootloader"
mtd1: 00040000 00020000 "Config"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00040000 00020000 "Factory"
mtd4: 00040000 00020000 "crash"
mtd5: 00040000 00020000 "crash_syslog"
mtd6: 00040000 00020000 "reserved0"
mtd7: 00400000 00020000 "kernel_stock"
mtd8: 00400000 00020000 "kernel"
mtd9: 07580000 00020000 "ubi"

mount output

/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/ubi0_1 on /overlay type ubifs (rw,noatime)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)

I didn't note down the layout previously under 19.07, but I suppose it probably looked similar to another 19.07.10 Openwrt instance I have running:

Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        2.5M      2.5M         0 100% /rom
tmpfs                tmpfs          60.8M      2.6M     58.1M   4% /tmp
/dev/mtdblock5       jffs2          11.5M      7.2M      4.3M  62% /overlay
overlayfs:/overlay   overlay        11.5M      7.2M      4.3M  62% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

I came across this post

that states:

If you are on my 18.x below, sysupgrading to a 19.07 image will not work. You have to manually mtd write the 19.07 "kernel-initramfs.bin" into the nand and boot/log into it (, then sysupgrade.

Is this the way to go? If so, what is the exact "mtd write" syntax, given the partition layout in 17.01 above? I don't how "nand" maps to the layout above, or in Breed.

Or, would it be more like the method in this post, recovering from a write-blocked 19.07?

openwrt-19.07.5-ramips-mt7621-xiaomi_mir3p-squashfs-factory.bin copied to /tmp

cd /tmp
dd if=factory.bin bs=1M count=4 | mtd write - kernel
Unlocking kernel ...

dd if=factory.bin bs=1M skip=4 | mtd write - ubi
Unlocking ubi ...

Writing from <stdin> to ubi ...  [e]4+0 records in
4+0 records out


Didn't work, as I noted:

my bad, deleted, then try to do it via breed.

there might be useful stuff in https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100