New install on Ruijie/Reyee RG-EW3200GX-PRO: initramfs boots but sysupgrade doesn’t: "Bad FIT kernel image format!"

BetaRays · September 28, 2025, 9:03pm

Hello, I tried to install OpenWRT on this device based on the following wiki pages: https://openwrt.org/toh/reyee/rg-e5 (contains actual information, seems to be an almost identical device, if not identical) and https://openwrt.org/toh/hwdata/ruijie/ruijie_rg-ew3200gx_pro (image files).

I managed to access the serial console, boot the initramfs, backup the original firmware, but flashing the sysupgrade firmware from the web console or using the sysupgrade command as instructed results in a boot error, including "Bad FIT kernel image format!" from the bootloader (I assume).

Is this expected? Did I do something wrong? I’m ready to give any information that might help.

Thanks in advance!

brada4 · September 28, 2025, 9:30pm

What “actual information” you are playing with?

Here is official guidance git commit

Please describe what file at what step you used - are you sure no errors were produced by sysupgrade at all?

BetaRays · September 28, 2025, 9:36pm

Those are the same installation instructions, the RG-E5 wiki page has information on serial port pinout which was useful as the other is mostly empty.
I booted https://downloads.openwrt.org/releases/24.10.2/targets/mediatek/mt7622/openwrt-24.10.2-mediatek-mt7622-ruijie_rg-ew3200gx-pro-initramfs-kernel.bin from the serial console, then ran sysupgrade with https://downloads.openwrt.org/releases/24.10.2/targets/mediatek/mt7622/openwrt-24.10.2-mediatek-mt7622-ruijie_rg-ew3200gx-pro-squashfs-sysupgrade.bin, with no error shown in the serial console.
Rewriting the original firmware seemed to work too.

frollic · September 28, 2025, 9:36pm

Those two have different flash layouts, which one do you actually own ?

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=7dbac3433fef1af0f76a515e962db450c3407c19

BetaRays · September 28, 2025, 9:40pm

How should I differentiate between the two?
If it matters, I also tried to flash the rg-e5 image at some point, with the same result (though I may have been on the wrong initramfs then).

frollic · September 28, 2025, 9:40pm

Bottom sticker on device ?

BetaRays · September 28, 2025, 9:43pm

“Model: RG-EW3200GX PRO”

frollic · September 28, 2025, 9:49pm

Perhaps you're getting this ...

BetaRays · September 28, 2025, 9:53pm

The boot logs seems to be the same. Is the conclusion that I should build an image with the modified DTS?

frollic · September 28, 2025, 10:08pm

Most likely, and if it works, perhaps submit it, so it'll get fixed once for all.

BetaRays · September 28, 2025, 10:08pm

Okay, thanks, I’ll try to do this when I have time.

frollic · September 28, 2025, 10:09pm

Fingers crossed!

BetaRays · September 29, 2025, 8:39pm

Alright, so I built two images: one with the default dts and one with topo22’s dts. None of them worked, so I thought I would reflash the original firmware to capture its logs and figure out what the offsets are on my router.

…And now mtd write /tmp/firmware.bin /dev/mtd7 doesn’t restore a bootable state anymore for some reason. Did I destroy some data at some point or something?

BetaRays · September 29, 2025, 8:49pm

Flashing an OpenWRT initramfs using U-Boot’s second option still works at least…

BetaRays · March 1, 2026, 4:31pm

Hello, it’s been some time but I think I managed to get sysupgrade to work.
So, the DTS from the other thread is too different from the current one to work I think (I think I remember testing it last time but I’m not sure I did).
I extracted the DTS from my backed up firmware (as mentionned in the instructions) using binwalk, and adjusted the relevant partition offsets, as in the other thread.

This gives me the following DTS and patch (I think the offsets are actually the same):

diff --git a/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
index 857f94ae94..dc9facb4ac 100644
--- a/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
+++ b/target/linux/mediatek/dts/mt7622-ruijie-rg-ew3200gx-pro.dts
@@ -26,49 +26,49 @@
 
 			partition@0 {
 				label = "Preloader";
-				reg = <0x0 0x40000>;
+				reg = <0x00 0x20000>;
 				read-only;
 			};
 
 			partition@40000 {
 				label = "ATF";
-				reg = <0x40000 0x20000>;
+				reg = <0x20000 0x10000>;
 				read-only;
 			};
 
 			partition@60000 {
 				label = "u-boot";
-				reg = <0x60000 0x50000>;
+				reg = <0x30000 0x50000>;
 				read-only;
 			};
 
 			partition@B0000 {
 				label = "u-boot-env";
-				reg = <0xb0000 0x20000>;
+				reg = <0x80000 0x10000>;
 			};
 
 			factory: partition@D0000 {
 				label = "Factory";
-				reg = <0xd0000 0x80000>;
+				reg = <0x90000 0x40000>;
 				read-only;
 			};
 
 			partition@150000 {
 				label = "product_info";
-				reg = <0x150000 0x10000>;
+				reg = <0xd0000 0x10000>;
 				read-only;
 			};
 
 			partition@160000 {
 				label = "kdump";
-				reg = <0x160000 0x10000>;
+				reg = <0xe0000 0x10000>;
 				read-only;
 			};
 
 			partition@170000 {
 				compatible = "denx,fit";
 				label = "firmware";
-				reg = <0x170000 0xe90000>;
+				reg = <0xf0000 0xf10000>;
 			};
 		};
 	};

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

/dts-v1/;
#include "mt7622-ruijie-rg-ew3200.dtsi"

/ {
	model = "Ruijie RG-EW3200GX PRO";
	compatible = "ruijie,rg-ew3200gx-pro", "mediatek,mt7622";
};

&nor_flash {
	status = "okay";

	pinctrl-names = "default";
	pinctrl-0 = <&spi_nor_pins>;

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <50000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "Preloader";
				reg = <0x00 0x20000>;
				read-only;
			};

			partition@40000 {
				label = "ATF";
				reg = <0x20000 0x10000>;
				read-only;
			};

			partition@60000 {
				label = "u-boot";
				reg = <0x30000 0x50000>;
				read-only;
			};

			partition@B0000 {
				label = "u-boot-env";
				reg = <0x80000 0x10000>;
			};

			factory: partition@D0000 {
				label = "Factory";
				reg = <0x90000 0x40000>;
				read-only;
			};

			partition@150000 {
				label = "product_info";
				reg = <0xd0000 0x10000>;
				read-only;
			};

			partition@160000 {
				label = "kdump";
				reg = <0xe0000 0x10000>;
				read-only;
			};

			partition@170000 {
				compatible = "denx,fit";
				label = "firmware";
				reg = <0xf0000 0xf10000>;
			};
		};
	};
};

&wmac {
	status = "okay";

	pinctrl-names = "default";
	pinctrl-0 = <&epa_elna_pins>;
	mediatek,mtd-eeprom = <&factory 0x0>;
};

&slot0 {
	wifi@0,0 {
		compatible = "mediatek,mt76";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&factory 0x5000>;
		ieee80211-freq-limit = <5000000 6000000>;
		mediatek,disable-radar-background;
	};
};

Now I’m lost on how to use the image (interfaces are down by default and LuCI isn’t auto-started apparently?), but I guess that’s a different problem.

BetaRays · March 2, 2026, 9:10pm

Okay, so I’ve narrowed down my issues to fw_printenv hangs using 50% of CPU according to top, which blocks most of the boot process.
Now I just need to figure out why…

Pinging @frollic in case you haven’t set this thread to “watch”, you might be interested.

BetaRays · March 2, 2026, 9:24pm

ah, /etc/fw_env.config contains /dev/mtd3 0x0 0x20000 0x20000, which I guess is wrong with my device tree? I changed 0x20000 to 0x10000 in the patch.

BetaRays · March 2, 2026, 9:38pm

Changing both 0x20000 to 0x10000, removing /tmp/lock/fw_printenv.lock and running fw_printenv seems to work. I saw that it’s created by /etc/uci-defaults/30_uboot-envtools but the only place I can find this file is in the build and staging directories: where should I change it in the source?

BetaRays · March 2, 2026, 9:41pm

It appears to be package/boot/uboot-envtools/files/mediatek_mt7622, I’ll try changing that and rebuilding.

BetaRays · March 3, 2026, 8:55am

I had to do a build from a clean clone for this change to take effect, but the images do seem to boot properly now.