Asus TUF Gaming AX6000 support

cookiemonster · February 3, 2026, 7:18pm

initramfs-kernel.bin. Mistyped.

Both just abort after what looks like a normal boot.

*** Warning - bad CRC, using default environment

Only thing that stood out was the above. @remittor I see you have a dump with bootloader.bin, factory.zip, and UBI_DEV.zip. Is that the next step?

I just RMA'ed a different unit for the same random bootlooping, so this could be a hardware fault.

Edit: Is it normal to have the top LED stay lit red when connected to usb ttl even after turning off? (CP2102)

root@OpenWrt-failsafe:/# df -h
Filesystem                Size      Used Available Use% Mounted on
tmpfs                   242.5M     29.9M    212.5M  12% /
tmpfs                   512.0K         0    512.0K   0% /dev
tmpfs                   242.5M     36.0K    242.4M   0% /tmp

root@OpenWrt-failsafe:/# ubinto /dev/ubi0 -a
ubi0
Volumes count:                           6
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     2016 (255983616 bytes, 244.1 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  38
Current maximum erase counter value:     11
Minimum input/output unit size:          2048 bytes
Character device major/minor:            250:0
Present volumes:                         0, 1, 2, 3, 4, 5

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        nvram
Character device major/minor: 250:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        8 LEBs (1015808 bytes, 992.0 KiB)
State:       OK
Name:        Factory
Character device major/minor: 250:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        8 LEBs (1015808 bytes, 992.0 KiB)
State:       OK
Name:        Factory2
Character device major/minor: 250:3
-----------------------------------
Volume ID:   3 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        578 LEBs (73392128 bytes, 69.9 MiB)
State:       OK
Name:        linux
Character device major/minor: 250:4
-----------------------------------
Volume ID:   4 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        578 LEBs (73392128 bytes, 69.9 MiB)
State:       OK
Name:        linux2
Character device major/minor: 250:5
-----------------------------------
Volume ID:   5 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        799 LEBs (101453824 bytes, 96.7 MiB)
State:       OK
Name:        jffs2
Character device major/minor: 250:6

cookiemonster · February 4, 2026, 8:04pm

Does anyone have or can locate OEM firmware with old bootloader? Asus pulled them. <3.0.0.4.388_33419 = old bootloader.

Wiki has 3.0.0.4.388_31374 which is likely initial release.

cookiemonster · February 4, 2026, 11:10pm

23.05.5 initramfs-kernel.bin:

Please press Enter to activate this console.
[    9.193581] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.204350] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    9.218459] Loading modules backported from Linux version v6.1.110-0-g5f55cad62cc9d
[    9.226107] Backport generated by backports.git v6.1.110-1-0-g965f73fc
[    9.332842] urngd: v1.0.2 started.
[    9.580704] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7986_rom_patch.bin failed with error -2
[    9.591055] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7986_rom_patch.bin
[    9.615938] mt798x-wmac: probe of 18000000.wifi failed with error -12
[    9.633987] PPP generic driver version 2.4.2
[    9.638778] NET: Registered PF_PPPOX protocol family
[    9.645456] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.984366] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   13.002549] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   13.011140] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   13.011216] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   13.029639] device eth0 entered promiscuous mode
[   13.034701] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[   13.044715] br-lan: port 1(lan1) entered blocking state
[   13.050020] br-lan: port 1(lan1) entered disabled state
[   13.056771] device lan1 entered promiscuous mode
[   13.072336] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   13.082397] br-lan: port 2(lan2) entered blocking state
[   13.087656] br-lan: port 2(lan2) entered disabled state
[   13.094603] device lan2 entered promiscuous mode
[   13.106014] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   13.115940] br-lan: port 3(lan3) entered blocking state
[   13.121249] br-lan: port 3(lan3) entered disabled state
[   13.128454] device lan3 entered promiscuous mode
[   13.139671] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   13.149515] br-lan: port 4(lan4) entered blocking state
[   13.154753] br-lan: port 4(lan4) entered disabled state
[   13.162129] device lan4 entered promiscuous mode
[   13.171172] mt7530-mdio mdio-bus:1f lan5: configuring for phy/2500base-x link mode
[   13.180537] br-lan: port 5(lan5) entered blocking state
[   13.185764] br-lan: port 5(lan5) entered disabled state
[   13.193181] device lan5 entered promiscuous mode
[   13.202242] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:06] driver [Maxlinear Ethernet GPY211C] (irq=POLL)
[   13.212471] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/2500base-x link mode
[   16.173936] mt7530-mdio mdio-bus:1f lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   16.173959] br-lan: port 1(lan1) entered blocking state
[   16.187065] br-lan: port 1(lan1) entered forwarding state
[   16.192907] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Watchdog handover: fd=3
- watchdog -
Watchdog does not have CARDRESET support
Mon Sep 23 12:39:21 UTC 2024 upgrade: Sending TERM to remaining processes ...
Mon Sep 23 12:39:25 UTC 2024 upgrade: Sending KILL to remaining processes ...
[  294.321605] stage2 (3104): drop_caches: 3
[  294.477383] block ubiblock0_6: released
Volume ID 5, size 2 LEBs (253952 bytes, 248.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "jffs2", alignment 1
Mon Sep 23 12:39:31 UTC 2024 upgrade: Switching to ramdisk...
Mon Sep 23 12:39:32 UTC 2024 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
Volume ID 3, size 33 LEBs (4190208 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "linux", alignment 1
Volume ID 6, size 43 LEBs (5459968 bytes, 5.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 164687872
Volume ID 7, size 1297 LEBs (164687872 bytes, 157.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount[  302.348317] reboot: Restarting system
 /tmp: Resource

23.05.5 completes the boot and luci functions; sysupgrade to that reports successful, but still just aborts. Tried 24, 25, and snapshot.

@remittor openwrt-23.05.5-250114-asus_tuf-ax6000-sysupgrade.bin gives out more errors and doesn't work either:

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.325128] mount_root: loading kmods from internal overlay
[   11.339970] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[   11.352582] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[   12.042342] UBIFS (ubi0:7): default file-system created
[   12.049639] UBIFS (ubi0:7): Mounting in unauthenticated mode
[   12.055355] UBIFS (ubi0:7): background thread "ubifs_bgt0_7" started, PID 643
[   12.255847] UBIFS (ubi0:7): UBIFS: mounted UBI device 0, volume 7, name "rootfs_data"
[   12.263674] UBIFS (ubi0:7): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   12.273565] UBIFS (ubi0:7): FS size: 141705216 bytes (135 MiB, 1116 LEBs), max 1127 LEBs, journal size 7110656 bytes (6 MiB, 56 LEBs)
[   12.285538] UBIFS (ubi0:7): reserved for root: 4952683 bytes (4836 KiB)
[   12.292137] UBIFS (ubi0:7): media format: w5/r0 (latest is w5/r0), UUID 4BE9D636-948E-4544-81CA-B3AC20B2FE69, small LPT model
[   12.305642] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   12.312675] block: unable to load configuration (fstab: Entry not found)
[   12.319389] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[   12.325842] block: unable to load configuration (fstab: Entry not found)
[   12.332551] block: attempting to load /etc/config/fstab
[   12.344941] block: unable to load configuration (fstab: Entry not found)
[   12.351663] block: no usable configuration
[   12.362672] UBIFS (ubi0:7): un-mount UBI device 0
[   12.367376] UBIFS (ubi0:7): background thread "ubifs_bgt0_7" stops
[   12.379413] UBIFS (ubi0:7): Mounting in unauthenticated mode
[   12.385136] UBIFS (ubi0:7): background thread "ubifs_bgt0_7" started, PID 646
[   12.585274] UBIFS (ubi0:7): UBIFS: mounted UBI device 0, volume 7, name "rootfs_data"
[   12.593093] UBIFS (ubi0:7): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   12.602985] UBIFS (ubi0:7): FS size: 141705216 bytes (135 MiB, 1116 LEBs), max 1127 LEBs, journal size 7110656 bytes (6 MiB, 56 LEBs)
[   12.614956] UBIFS (ubi0:7): reserved for root: 4952683 bytes (4836 KiB)
[   12.621551] UBIFS (ubi0:7): media format: w5/r0 (latest is w5/r0), UUID 4BE9D636-948E-4544-81CA-B3AC20B2FE69, small LPT model
[   13.170207] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   13.177199] block: unable to load configuration (fstab: Entry not found)
[   13.183922] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[   13.190389] block: unable to load configuration (fstab: Entry not found)
[   13.197091] block: attempting to load /etc/config/fstab
[   13.202332] block: unable to load configuration (fstab: Entry not found)
[   13.209037] block: no usable configuration
[   13.214972] mount_root: overlay filesystem has not been fully initialized yet
[   13.222251] mount_root: switching to ubifs overlay
[   13.243203] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[   13.254109] urandom-seed: Seed file not found (/etc/urandom.seed)
Scanning for Btrfs filesystems
[   13.775480] mtdblock: MTD device 'Bootloader' is NAND, please consider using UBI block devices instead.
[   14.225476] mtdblock: MTD device 'UBI_DEV' is NAND, please consider using UBI block devices instead.
[   14.518825] mt7530-mdio mdio-bus:1f lan1: Link is Down
[   14.526622] procd: - early -
[   14.529564] procd: - watchdog -
[   15.142884] procd: - watchdog -
[   15.232240] procd: - ubus -
[   15.350808] procd: - init -
Please press Enter to activate this console.
[   15.922923] kmodloader: loading kernel modules from /etc/modules.d/*
[   16.013146] urngd: v1.0.2 started.
[   16.018000] NET: Registered PF_ALG protocol family
[   16.030585] Key type dns_resolver registered
[   16.041846] Key type cifs.idmap registered
[   16.050039] ntfs: driver 2.1.32 [Flags: R/O MODULE].
[   16.056538] tun: Universal TUN/TAP device driver, 1.6
[   16.069223] l2tp_core: L2TP core driver, V2.0
[   16.074462] l2tp_netlink: L2TP netlink interface
[   16.080100] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[   16.088531] gre: GRE over IPv4 demultiplexor driver
[   16.094267] ip_gre: GRE over IPv4 tunneling driver
[   16.101657] ip6_gre: GRE over IPv6 tunneling driver
[   16.130394] GACT probability on
[   16.134062] Mirror/redirect action on
[   16.140973] u32 classifier
[   16.143684]     input device check on
[   16.147329]     Actions configured
[   16.155275] fuse: init (API version 7.34)
[   16.161323] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   16.180737] {natflow}:natflow_init(): natflow_major=248, natflow_minor=0
[   16.187562] {natflow}:natflow_zone_init(): natflow_zone_major=247, natflow_zone_minor=0
[   16.195671] {natflow}:natflow_user_init(): natflow_user_major=246, natflow_user_minor=0
[   16.203757] {natflow}:userinfo_init(): userinfo_major=245, userinfo_minor=0
[   16.210780] {natflow}:userinfo_event_init(): userinfo_event_major=244, userinfo_event_minor=0
[   16.219396] {natflow}:qos_init(): qos_major=243, qos_minor=0
[   16.225159] {natflow}:conntrackinfo_init(): conntrackinfo_major=242, conntrackinfo_minor=0
[   16.233535] {natflow}:natflow_probe_ct_ext(): probe static_fixed_ext_off = 12
[   16.233535] 
[   16.242177] {natflow}:vline_fwd_map_config_apply(): apply config
[   16.248200] {natflow}:vline_fwd_map_ifup_handle(): handle event for dev=eth0
[   16.255238] {natflow}:natflow_netdev_event(): catch NETDEV_UP event for dev=eth0(tso=1,1,hw_csum=1,1), add ingress hook
[   16.266050] {natflow}:natflow_urllogger_init(): urllogger_major=241, urllogger_minor=0
[   16.274125] {natflow}:natflow_hostacl_init(): hostacl_major=240, hostacl_minor=0
[   16.283725] Bridge firewalling registered
[   16.288432] Loading modules backported from Linux version v6.1.110-0-g5f55cad62cc9d
[   16.296088] Backport generated by backports.git v6.1.110-1-0-g965f73fc
[   16.351267] usbcore: registered new interface driver usblp
[   16.364780] xt_time: kernel timezone is -0000
[   16.745746] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221012174648a
[   16.745746] 
[   17.069734] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221012174725
[   17.218166] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221012174937

remittor · February 5, 2026, 7:16am

@cookiemonster , You're not explaining your problem clearly.
Show me the full log of my TRX image installation and loading.

cookiemonster · February 5, 2026, 7:55am

Problem: sysupgrade to 24.10.5 triggered this bootloop

Serial:
initramfs - only 23.x boots now.
sysupgrade - none boot; bootloop is triggered at "mt798x-wmac 18000000.wifi...."

Asus restore:
ubcleaner + OEM - appears to complete the boot (OEM log matches wiki), but still resets

ASUS_TUF-AX6000/openwrt-initramfs-bin-for-luci/openwrt-23_tuf-ax6000-initramfs.bin:

NOTICE:  BL2: v2.6(release):
NOTICE:  BL2: Built : 14:42:59, Jul 22 2022
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 512MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):
NOTICE:  BL31: Built : 14:43:05, Jul 22 2022

U-Boot 2022.04-rc1 (Mar 29 2023 - 14:23:46 +0800)
TUF-AX6000 bootloader version: 1.0.0.4

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
Core:  43 devices, 15 uclasses, devicetree: embed
MMC:   mmc@11230000: 0
Loading Environment from MTD... 
SPINAND raw ID: 00 EF AA 22 
spi-nand: spi_nand spi_nand@1: Winbond W25N02KV SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128, ECC strength 8/512, custom ECC status.
*** Warning - bad CRC, using default environment

In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
ASUS TUF-AX6000 gpio/led init
Net:   
Warning: ethernet1@15100000 (eth0) using random MAC address - 46:7a:c5:db:53:a5
eth0: ethernet1@15100000
Warning: ethernet0@15100000 (eth1) using random MAC address - be:40:a9:e8:53:54
, eth1: ethernet0@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 252 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 2016, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 6, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 892961766
ubi0: available PEBs: 0, total reserved PEBs: 2016, PEBs reserved for bad PEB handling: 40
UBI:   vol_id  reserved_pebs  alignment  data_pad  vol_type  usable_leb_size  used_ebs  used_bytes  last_eb_bytes  corrupted  upd_marker  name_len  name
UBI:        0              1          1         0   dynamic            1f000         1       1f000         1f000          0           0         5  nvram
UBI:        1              8          1         0   dynamic            1f000         8       f8000         1f000          0           0         7  Factory
UBI:        2              8          1         0   dynamic            1f000         8       f8000         1f000          0           0         8  Factory2
UBI:        3            242          1         0   dynamic            1f000       242     45fe000         1f000          0           0         5  linux
UBI:        4            242          1         0   dynamic            1f000       242     45fe000         1f000          0           0         6  linux2
UBI:        5            31f          1         0   dynamic            1f000       31f     60c1000         1f000          0           0         5  jffs2
UBI: 7fffefff              2          1         0   dynamic            1f000         2       3e000             2          0           0         d  layout volume
Read 1015808 bytes from volume Factory to 000000005f707ac0
EEPROM set 0: OK (version 79)
Read 1015808 bytes from volume Factory2 to 000000005f707ac0
EEPROM set 1: OK (version 79)
Read 1015808 bytes from volume Factory to 000000005fb42630
Select EEPROM set 0 at offset 0x0.

Please choose the operation: 
   1: Load System code to SDRAM via TFTP.
   2: Load System code then write to Flash via TFTP.
   3: Boot System code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 4

   4: Entr boot command line interface.

U-Boot 2022.04-rc1 (Mar 29 2023 - 14:23:46 +0800)
MT7986> setenv ipaddr 192.168.1.1
MT7986> setenv ipaddr 192.168.1.1 70addr 192.168.1.70 addr 192.168.1.70 saddr 192.168.1.70eaddr 192.168.1.70raddr 192.168.1.70vaddr 192.168.1.70eaddr 192.168.1.70raddr 192.168.1.70addr 192.168.1.70
MT7986> tftb   ftpboot 0x46000000 tufax6000.bin
switch prereq:0
Using ethernet0@15100000 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'tufax6000.bin'.
Load address: 0x46000000
Loading: *Got ARP REPLY, set eth addr (60:cf:84:a8:9d:78)
#################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ################################
	 16.9 MiB/s
done
Bytes transferred = 13828096 (d30000 hex)
MT7986> tftpboot 0x46000000 tufax6000.bin              0x46000000 0x46000000 0x46000000 0x46000000 0x46000000 0x46000000 0x46000000 0x46000000 0x46000000 b0x46000000o0x46000000o0x46000000t0x46000000m0x46000000 0x46000000
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.162
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    13795057 Bytes = 13.2 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   20741263
     Hash algo:    sha1
     Hash value:   c6b430201bd32aee6b5a160f88741d4a6d1e196c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt asus_tuf-ax6000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46d28120
     Data Size:    20976 Bytes = 20.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   673867ac
     Hash algo:    sha1
     Hash value:   e03817f58a8f07ca78bc7ac54d1954f59b1d2129
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x46d28120
   Uncompressing Kernel Image
   Loading Device Tree to 000000005f7f2000, end 000000005f7fa1ef ... OK
volume linux seq: 4

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.162 (user@debian) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24012-d8dd03c46f) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Jul 15 22:14:18 2024
[    0.000000] Machine model: ASUS TUF-AX6000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fbfffff]
[    0.000000]   node   0: [mem 0x000000004fc00000-0x000000004ffbffff]
[    0.000000]   node   0: [mem 0x000000004ffc0000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s33112 r8192 d32424 u73728
[    0.000000] pcpu-alloc: s33112 r8192 d32424 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: ubi.mtd=UBI_DEV
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 488528K/524288K available (8384K kernel code, 906K rwdata, 1488K rodata, 10048K init, 300K bss, 35760K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] Root IRQ handler: 0xffffffc008010090
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000111] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000119] pid_max: default: 32768 minimum: 301
[    0.000317] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000326] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001352] rcu: Hierarchical SRCU implementation.
[    0.001621] smp: Bringing up secondary CPUs ...
[    0.001874] Detected VIPT I-cache on CPU1
[    0.001897] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.001923] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.002178] Detected VIPT I-cache on CPU2
[    0.002191] GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
[    0.002202] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.002436] Detected VIPT I-cache on CPU3
[    0.002446] GICv3: CPU3: found redistributor 3 region 0:0x000000000c0e0000
[    0.002455] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.002481] smp: Brought up 1 node, 4 CPUs
[    0.002494] SMP: Total of 4 processors activated.
[    0.002498] CPU features: detected: 32-bit EL0 Support
[    0.002502] CPU features: detected: CRC32 instructions
[    0.002526] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.002579] CPU: All CPU(s) started at EL2
[    0.002589] alternatives: patching kernel code
[    0.005009] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005030] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.005178] pinctrl core: initialized pinctrl subsystem
[    0.005805] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.006038] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006059] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006081] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.006333] thermal_sys: Registered thermal governor 'fair_share'
[    0.006336] thermal_sys: Registered thermal governor 'bang_bang'
[    0.006339] thermal_sys: Registered thermal governor 'step_wise'
[    0.006342] thermal_sys: Registered thermal governor 'user_space'
[    0.006511] ASID allocator initialised with 65536 entries
[    0.006826] pstore: Registered ramoops as persistent store backend
[    0.006830] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.014804] cryptd: max_cpu_qlen set to 1000
[    0.016554] SCSI subsystem initialized
[    0.016639] libata version 3.00 loaded.
[    0.017439] clocksource: Switched to clocksource arch_sys_counter
[    0.017965] NET: Registered PF_INET protocol family
[    0.018037] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.018399] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.018410] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.018416] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.018437] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.018480] TCP: Hash tables configured (established 4096 bind 4096)
[    0.018534] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.018546] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.018645] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.018664] PCI: CLS 0 bytes, default 64
[    0.039495] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.042190] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.042205] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.064544] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.068386] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.070031] printk: console [ttyS0] disabled
[    0.090217] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 121, base_baud = 2500000) is a ST16650V2
[    0.729223] printk: console [ttyS0] enabled
[    0.734090] mtk_rng 1020f000.rng: registered RNG driver
[    0.734148] hwrng: no data available
[    0.742924] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.751182] loop: module loaded
[    0.754328] Loading iSCSI transport class v2.0-870.
[    0.760517] spi spi0.0: setup: ignoring unsupported mode bits a00
[    0.766885] spi-nand spi0.0: Winbond SPI NAND was found.
[    0.772207] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.828030] 2 fixed-partitions partitions found on MTD device spi0.0
[    1.834386] Creating 2 MTD partitions on "spi0.0":
[    1.839172] 0x000000000000-0x000000400000 : "Bootloader"
[    1.848899] 0x000000400000-0x000010000000 : "UBI_DEV"
[    2.238606] mtk_soc_eth 15100000.ethernet: generated random MAC address c6:24:01:54:2c:d2
[    2.246831] mtk_soc_eth 15100000.ethernet: generated random MAC address 7a:2c:15:2a:9c:78
[    2.367401] Maxlinear Ethernet GPY211C mdio-bus:05: Firmware Version: 0x886F (release)
[    2.385506] Maxlinear Ethernet GPY211C mdio-bus:06: Firmware Version: 0x886F (release)
[    2.395955] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc00a180000, irq 129
[    2.405740] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc00a180000, irq 129
[    2.415249] i2c_dev: i2c /dev entries driver
[    2.420509] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    2.428957] NET: Registered PF_INET6 protocol family
[    2.434571] Segment Routing with IPv6
[    2.438266] In-situ OAM (IOAM) with IPv6
[    2.442208] NET: Registered PF_PACKET protocol family
[    2.447261] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.460313] 8021q: 802.1Q VLAN Support v1.8
[    2.465307] pstore: Using crash dump compression: deflate
[    2.517229] mt7530-mdio mdio-bus:1f: no interrupt support
[    2.541134] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    2.550292] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.559230] MediaTek MT7531 PHY mt7530-0:01: Configure LED registers (num=14)
[    2.573752] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=POLL)
[    2.593798] MediaTek MT7531 PHY mt7530-0:02: Configure LED registers (num=14)
[    2.608331] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=POLL)
[    2.628065] MediaTek MT7531 PHY mt7530-0:03: Configure LED registers (num=14)
[    2.642593] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=POLL)
[    2.662303] MediaTek MT7531 PHY mt7530-0:04: Configure LED registers (num=14)
[    2.676836] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=POLL)
[    2.688030] mt7530-mdio mdio-bus:1f lan5 (uninitialized): PHY [mdio-bus:05] driver [Maxlinear Ethernet GPY211C] (irq=POLL)
[    2.699398] DSA: tree 0 setup
[    2.702636] ubi0: default fastmap pool size: 100
[    2.707241] ubi0: default fastmap WL pool size: 50
[    2.712039] ubi0: attaching mtd1
[    5.027438] random: crng init done
[    6.829757] ubi0: scanning is finished
[    6.856639] ubi0 warning: 0xffffffc00856d794: cannot reserve enough PEBs for bad PEB handling, reserved 38, need 40
[    6.867738] ubi0: attached mtd1 (name "UBI_DEV", size 252 MiB)
[    6.873563] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.880424] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.887190] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.894133] ubi0: good PEBs: 2016, bad PEBs: 0, corrupted PEBs: 0
[    6.900208] ubi0: user volume: 6, internal volumes: 1, max. volumes count: 128
[    6.907408] ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 892961766
[    6.916517] ubi0: available PEBs: 0, total reserved PEBs: 2016, PEBs reserved for bad PEB handling: 38
[    6.925807] ubi0: background thread "ubi_bgt0d" started, PID 465
[    6.925974] clk: Disabling unused clocks
[    6.939390] Freeing unused kernel memory: 10048K
[    6.944063] Run /init as init process
[    6.947713]   with arguments:
[    6.950665]     /init
[    6.952923]   with environment:
[    6.956046]     HOME=/
[    6.958393]     TERM=linux
[    7.168787] init: Console is alive
[    7.172273] init: - watchdog -
[    7.178539] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    7.189421] usbcore: registered new interface driver usbfs
[    7.194926] usbcore: registered new interface driver hub
[    7.200282] usbcore: registered new device driver usb
[    7.209933] xhci-mtk 11200000.usb: xHCI Host Controller
[    7.215168] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 1
[    7.225630] xhci-mtk 11200000.usb: hcc params 0x01403f99 hci version 0x110 quirks 0x0000000000210010
[    7.234785] xhci-mtk 11200000.usb: irq 123, io mem 0x11200000
[    7.240608] xhci-mtk 11200000.usb: xHCI Host Controller
[    7.245817] xhci-mtk 11200000.usb: new USB bus registered, assigned bus number 2
[    7.253202] xhci-mtk 11200000.usb: Host supports USB 3.2 Enhanced SuperSpeed
[    7.260573] hub 1-0:1.0: USB hub found
[    7.264326] hub 1-0:1.0: 2 ports detected
[    7.268644] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    7.276953] hub 2-0:1.0: USB hub found
[    7.280712] hub 2-0:1.0: 1 port detected
[    7.286984] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.298696] init: - preinit -
[    7.354530] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    7.363003] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    7.371712] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
ip: SIOCSIFHWADDR: Resource busy
[    7.530808] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[    7.544661] mt7530-mdio mdio-bus:1f lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[    7.552653] IPv6: ADDRCONF(NETDEV_CHANGE): lan1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.570063] mt7530-mdio mdio-bus:1f lan1: Link is Down
[    9.577805] procd: - early -
[    9.580732] procd: - watchdog -
[   10.096913] procd: - watchdog -
[   10.100215] procd: - ubus -
[   10.153332] procd: - init -
Please press Enter to activate this console.
[   10.241637] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.252308] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   10.266070] Loading modules backported from Linux version v6.1.97-0-g7753af06eebfb
[   10.273816] Backport generated by backports.git v6.1.97-1-0-g2431d56e
[   10.383054] urngd: v1.0.2 started.
[   10.630818] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221012174648a
[   10.630818] 
[   10.649081] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221012174725
[   10.685391] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221012174937


F0: 102B 0000

FA: 1040 0000

FA: 1040 0000 [0200]

F9: 0000 0000

V0: 0000 0000 [0001]

00: 0000 0000

BP: 2400 0041 [0000]

G0: 1190 0000

EC: 0000 0000 [1000]

T0: 0000 0209 [010F]

Jump to BL

NOTICE:  BL2: v2.6(release):
NOTICE:  BL2: Built : 14:42:59, Jul 22 2022
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (2000MHz)

cookiemonster · February 5, 2026, 8:10am

openwrt-23.05.5-mediatek-filogic-asus_tuf-ax6000-initramfs-kernel.bin
openwrt-23.05.5-250114-asus_tuf-ax6000-sysupgrade.bin (yours)

(https://pastes.io/1-32789)

Tell me the specific things you want to see and sent however, and I will post it. Only vanilla openwrt 23.x initramfs will boot to luci.

remittor · February 5, 2026, 8:37am

@cookiemonster
In the bootloader console, run the following commands:

ubi part UBI_DEV
ubi remove linux
ubi remove linux2
ubi remove rootfs
ubi remove rootfs_data
ubi remove jffs2
ubi detach

After this, perform a reset (or reboot the router).

Then loading the TRX-file, which you need to take from here: https://github.com/openwrt-xiaomi/builder/releases/tag/v24-260120-trx
Record all actions and save them in a log (increase the buffer in the SSH client).

cookiemonster · February 5, 2026, 8:52am

(https://pastes.io/2-98997)

Hello!! Enter Recuse Mode: (Check error)

switch prereq:0
tftpd start

Our IP address is:(192.168.1.1)
Wait for TFTP request...

Don't know what was supposed to happen.

remittor · February 5, 2026, 9:31am

@cookiemonster
tftpboot 0x46000000 tufax6000.trx - This is not the correct command!

TRX images need to be loaded differently.
I don't remember exactly how to do it through the console. But the bootloader should work correctly using the ASUS utility. It also deletes the first 0x40 bytes of the transferred image.

You don’t delete these first 0x40 bytes from the image!

Use the standard Asus Rescue utility to transfer the image with the name TUF-AX6000.trx

Note: Image UBI_cleaner.trx must be loaded in the same way!

remittor · February 5, 2026, 9:42am

cookiemonster · February 5, 2026, 7:08pm

ubi commands + tftp = bootloop
ubi commands + Asus Rescue in windows = bootloop
ubi commands + option #2 in console = bootloop

Here is the full log for #3 : https://pastes.io/3-89870

remittor · February 5, 2026, 7:17pm

[   10.092532] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823160656a
[   10.092532] 
[   10.111215] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823160721
[   10.147664] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823160840
[   10.254395] mt798x-wmac 18000000.wifi: missing precal data, siz

Your Factory or Factory2 volumes are probably damaged.
Or you have a hardware problem with WiFi.

And as luck would have it, all my firmware versions try to activate the WiFi module

cookiemonster · February 5, 2026, 7:30pm

I already have factory/factory2 from you drive. Can these be fixed via serial?

Regular initramfs v23.x boots fine... somehow which makes this so weird.

remittor · February 5, 2026, 7:31pm

How me logs.
Then you can restore these volumes from this working system (after making a backup).

cookiemonster · February 5, 2026, 7:35pm

Already posted:
(Asus TUF Gaming AX6000 support - #1189 by cookiemonster)

Completes the boot. I can get into luci and ssh. Log shows I did a sysupgrade from luci which fails.

remittor · February 5, 2026, 7:43pm

Disable facinstall service.
Or update facinstall package.

cookiemonster · February 5, 2026, 7:56pm

Edit:
@remittor

Hitting enter to enter the console + quickly launching top somehow worked to prevent the bootloop. 25.12.0-rc4 initramfs worked. sysupgrade worked.

I built 25.12.0-rc4 and removed all wireless.
(https://pastebin.com/sCUVHXKu)

Problem is wireless and likely factory/factory2 so I saw how to restore:

(Asus TUF Gaming AX6000 support - #794 by hnlxl)

ubiupdatevol /dev/ubi0_1 /tmp/factory.bin
ubiupdatevol /dev/ubi0_2 /tmp/factory2.bin

ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:256
Present UBI devices:            ubi0

ubi0
Volumes count:                           8
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     2016 (255983616 bytes, 244.1 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  40
Current maximum erase counter value:     16
Minimum input/output unit size:          2048 bytes
Character device major/minor:            251:0
Present volumes:                         0, 1, 2, 3, 4, 5, 6, 7

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        nvram
Character device major/minor: 251:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        8 LEBs (1015808 bytes, 992.0 KiB)
State:       OK
Name:        Factory
Character device major/minor: 251:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        8 LEBs (1015808 bytes, 992.0 KiB)
State:       OK
Name:        Factory2
Character device major/minor: 251:3
-----------------------------------

Tried the above to restore factory/factory2 but it has no affect. Any sysupgrade with wireless bootloops.

remittor · February 6, 2026, 8:14am

What about backups?
Without your broken images, it will be difficult to reproduce the problem and fix it!

remittor · February 6, 2026, 8:16am

So try installing the firmware without Wi-Fi.

cookiemonster · February 6, 2026, 8:20am

Did. Built initramfs and sysupgrade without wireless. I have openwrt installed. Now my problem is getting wireless back to working.

Factory/factory2 is found in this thread and in your google drive. Can I not use that to get back wireless? No, I do not have my own backups from this unit. I do have another unit that is still working that I could grab from.