@boliva
I took a look at my router's mtd table and I think I may have been misunderstanding it.
dev: size erasesize name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "Bdata"
mtd3: 00010000 00010000 "factory"
mtd4: 00010000 00010000 "crash"
mtd5: 00010000 00010000 "cfg_bak"
mtd6: 00100000 00010000 "overlay"
mtd7: 00e80000 00010000 "firmware"
mtd8: 001de405 00010000 "kernel"
mtd9: 00ca1bfb 00010000 "rootfs"
mtd10: 00950000 00010000 "rootfs_data"
Someone correct me if I'm wrong, but the kernel, rootfs and rootfs_data are contained in the firmware (mtd7) partition, being the kernel at offset 0 of it. I copied to my machine and ran binwalk, looks like so:
[rod@zoo tmp]$ ls -l mtd*
-rw-r--r-- 1 rod rod 15204352 Oct 23 02:27 mtd7
-rw-r--r-- 1 rod rod 1958917 Oct 23 02:27 mtd8
-rw-r--r-- 1 rod rod 13245435 Oct 23 02:27 mtd9
[rod@zoo tmp]$ binwalk mtd7
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x445AAE3E, created: 2020-09-06 16:19:39, image size: 1958853 bytes, Data Address: 0x80001000, Entry Point: 0x80001000, data CRC: 0x17A6FC50, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.14.195"
64 0x40 LZMA compressed data, properties: 0x6D, dictionary size: 2097152 bytes, uncompressed size: 6270088 bytes
1958917 0x1DE405 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3425314 bytes, 1643 inodes, blocksize: 262144 bytes, created: 2020-09-06 16:19:39
5439488 0x530000 JFFS2 filesystem, little endian
[rod@zoo tmp]$ binwalk mtd8
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x445AAE3E, created: 2020-09-06 16:19:39, image size: 1958853 bytes, Data Address: 0x80001000, Entry Point: 0x80001000, data CRC: 0x17A6FC50, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.14.195"
64 0x40 LZMA compressed data, properties: 0x6D, dictionary size: 2097152 bytes, uncompressed size: 6270088 bytes
[rod@zoo tmp]$ binwalk mtd9
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3425314 bytes, 1643 inodes, blocksize: 262144 bytes, created: 2020-09-06 16:19:39
3480571 0x351BFB JFFS2 filesystem, little endian
Also, take a look at when the router boots, taken from dmesg
:
[ 2.504973] Creating 8 MTD partitions on "spi0.0":
[ 2.509749] 0x000000000000-0x000000030000 : "u-boot"
[ 2.515688] 0x000000030000-0x000000040000 : "u-boot-env"
[ 2.521789] 0x000000040000-0x000000050000 : "Bdata"
[ 2.527561] 0x000000050000-0x000000060000 : "factory"
[ 2.533478] 0x000000060000-0x000000070000 : "crash"
[ 2.539278] 0x000000070000-0x000000080000 : "cfg_bak"
[ 2.545309] 0x000000080000-0x000000180000 : "overlay"
[ 2.551212] 0x000000180000-0x000001000000 : "firmware"
[ 2.557481] 2 uimage-fw partitions found on MTD device firmware
[ 2.563384] Creating 2 MTD partitions on "firmware":
[ 2.568404] 0x000000000000-0x0000001de405 : "kernel"
[ 2.574298] 0x0000001de405-0x000000e80000 : "rootfs"
[ 2.580117] mtd: device 9 (rootfs) set to be root filesystem
[ 2.585898] 1 squashfs-split partitions found on MTD device rootfs
[ 2.592072] 0x000000530000-0x000000e80000 : "rootfs_data"
So if I'm interpreting this correctly, the notes on my mir4ag-19.07-20200722 release were almost correct... except that since it doesn't identify the flashed initramfs image on the "firmware" partition as a "multiple sub-partition" one (since it is not a squashfs sysupgrade image yet), we should flash the sysupgrade image on that "firmware" mtd partition. I now think that the correct command on the last part of the notes should be:
mtd -e firmware -r write openwrt-ramips-mt7621-xiaomi_mir3g-v2-squashfs-sysupgrade.bin firmware
However I don't want to brick your router permanently, so I won't really ask you to try it without a big fat warning: although I think you'll still be able to reflash original firmware with TFTP method if it doesn't work, I can't be 100% sure so be warned
I currently don't have my flasher (a friend borrowed it some months ago and it may take some days to ask it back) or I would try it myself knowing I would be able to recover...
Is anyone here with a flasher able to try this in the meanwhile (having made a backup of the full flash first of course)? Or if someone can confirm that what I wrote above is harmless and will work...
Edit: corrected the mtd command, it's getting late and I should be sleeping now