Extracting a firmware image via U-Boot and mounting/expanding it

I’m attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the firmware must be dumped via U-boot.

The question has been asked before here, but I would like to know how the flash offset and the length was determined for the sf read [addr] [offset] [len] command?

Additionally, I want to know how to then mount or expand the flash dump. Apparently, it can be done with either binwalk -Me or sudo mount -t cramfs -o loop romfs.cramfs /media/cramfs? But I’ve had some issues, firstly I can’t mount the filesystem because of the unknown filesystem type ‘cramfs’ (despite getting and installing cramfsprogs with sudo dpkg -i ./cramfsprogs_1.1-6ubuntu1_amd64.deb). Using binwalk to extract the filesystem doesn’t seem to yield anything meaningful either.