Is that possible to use:

mtd -e firmware write <backup-firmware mtd6> or

dd if=<backup-firmware mtd6> of=/dev/mtdblock6

I've upgraded my Buffalo WZR-HP-G300NH from factory firmware to dd-wrt and then to openwrt backfire 10.03.1-rc3. I backed up dd-wrt mtd partitions before flashing openwrt using command dd if=/dev/mtdblockX of=mtdX.bin and got the following files:

384K 2010-08-31 11:07 mtdblock0-RedBoot.bin
32M 2010-08-31 11:07 mtdblock1-linux.bin
12M 2010-08-31 11:07 mtdblock2-rootfs.bin
20M 2010-08-31 11:08 mtdblock3-ddwrt.bin
128K 2010-08-31 11:08 mtdblock4-nvram.bin
128K 2010-08-31 11:08 mtdblock5-board_config.bin
32M 2010-08-31 11:08 mtdblock6-fullflash.bin

I upgraded from dd-wrt to openwrt with command
mtd -e linux -r write linux openwrt-ar71xx-wzr-hp-g300nh-jffs2-tftp.trx (stripped first 32 bit from .bin file)

Now I got slightly different mtd partitions layout, could be because dd-wrt is squashfs and openwrt is jffs?

root@WZR-HP-G300NH:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "u-boot"
mtd1: 00020000 00020000 "u-boot-env"
mtd2: 00100000 00020000 "kernel"
mtd3: 01e60000 00020000 "rootfs"
mtd4: 00020000 00020000 "user_property"
mtd5: 00020000 00020000 "art"
mtd6: 01f60000 00020000 "firmware"

and extracted bin files using command dd if=/dev/mtdblockX of=mtdblockX_<name>.bin
256K mtd0_u-boot.bin
128K mtd1_u-boot-env.bin
1.0M mtd2_kernel.bin
31M mtd3_rootfs.bin
128K mtd4_user_property.bin
128K mtd5_art.bin
32M mtd6_firmware.bin

I would very much appreciate advises and explanation on mtd partition layout and editing. Is it safe to write to flash from terminal console, instead of using painful tftp method or WebGUI, which doesnt accept different vendor binary firmware image?

Thank you,

Can you post the mtd list printed in dmesg?

I think the mtd6 (firmware) is the right one to back up but you should make sure that it only covers kernel and rootfs, not stuff like "art" or "u-boot".
Writing to mtd with dd is possible, when you do this use a 128KB blocksize.

I got a few messages on mtd repartitioning while it took first boot after "mtd -e linux -r write linux firmware.trx" but those were cleared as my router has been up for 2 days.

Comparing mtd partitions in dd-wrt and openwrt:

openwrt                  dd-wrt
u-boot+u-boot-env=RedBoot
kernel=linux
user_property=nvram
art=board_config

Both u-boot and RedBoot partitions provide fail-save reboot and initial tftp service.
Kernel and linux partitions contain zipped kernel binary images and will install it's rootfs automatically if needed. Automatic install process will do repartition mtd and boot loader if necessary.

So I guess firmware upgrade is to write to mtd partition linux in dd-wrt or kernel in openwrt. u-boot and RedBoot launched first with the router power up and it will load linux or kernel. If rootfs doesnt exist, packed linux kernel will explode itself to make rootfs partitions, otherwise it call software packages in rootfs to finish boot process.

I am still concerned if my router will brick if u-boot code can't load dd-wrt linux partition or RedBoot can't load openwrt kernel. If that the case, then writing to mtd with dd is much safer to upgrade firmware