AX3600 Wifi crash

Hi everyone.
I tried already 2 different builds of the snapshot on the Xiaomi AX3600.

There's no way to make the wifi on the atk11 working.
The driver crashes.
Here's the dmesg.

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.98 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22247-fb06f533b3) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Tue Mar 7 21:31:36 2023
[    0.000000] Machine model: Xiaomi AX3600
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004a4fffff]
[    0.000000]   node   0: [mem 0x000000004a500000-0x000000004a5fffff]
[    0.000000]   node   0: [mem 0x000000004a600000-0x000000004e8fffff]
[    0.000000]   node   0: [mem 0x000000004e900000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] percpu: Embedded 17 pages/cpu s30808 r8192 d30632 u69632
[    0.000000] pcpu-alloc: s30808 r8192 d30632 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait uart_en=1 root=/dev/ubiblock0_0
[    0.000000] Unknown kernel command line parameters "uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 415348K/524288K available (7808K kernel code, 860K rwdata, 2136K rodata, 1280K init, 288K bss, 108940K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000120] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000137] pid_max: default: 32768 minimum: 301
[    0.000289] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000305] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001970] rcu: Hierarchical SRCU implementation.
[    0.002145] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.002695] smp: Bringing up secondary CPUs ...
[    0.003318] Detected VIPT I-cache on CPU1
[    0.003384] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.004016] Detected VIPT I-cache on CPU2
[    0.004056] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.004648] Detected VIPT I-cache on CPU3
[    0.004686] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.004752] smp: Brought up 1 node, 4 CPUs
[    0.004777] SMP: Total of 4 processors activated.
[    0.004785] CPU features: detected: 32-bit EL0 Support
[    0.004792] CPU features: detected: CRC32 instructions
[    0.004841] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.004851] CPU: All CPU(s) started at EL1
[    0.004873] alternatives: patching kernel code
[    0.012611] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.012649] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.012817] pinctrl core: initialized pinctrl subsystem
[    0.014102] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.014576] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.014620] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.014657] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.015000] thermal_sys: Registered thermal governor 'step_wise'
[    0.016382] cpuidle: using governor menu
[    0.016614] ASID allocator initialised with 65536 entries
[    0.069449] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.078249] SCSI subsystem initialized
[    0.078429] usbcore: registered new interface driver usbfs
[    0.078476] usbcore: registered new interface driver hub
[    0.078511] usbcore: registered new device driver usb
[    0.078741] CPUidle PSCI: failed to enable OSI mode: -95
[    0.079039] qcom_scm: convention: smc arm 64
[    0.080447] clocksource: Switched to clocksource arch_sys_counter
[    0.081236] NET: Registered PF_INET protocol family
[    0.081370] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.082023] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.082048] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.082062] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.082113] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.082194] TCP: Hash tables configured (established 4096 bind 4096)
[    0.082275] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.082302] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.082462] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.082495] PCI: CLS 0 bytes, default 64
[    0.083577] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.087345] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.087364] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.088125] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.090269] qcom-qmp-phy 84000.phy: Registered Qcom-QMP phy
[    0.092483] qcom-pcie 20000000.pci: host bridge /soc/pci@20000000 ranges:
[    0.092545] qcom-pcie 20000000.pci:       IO 0x0020200000..0x002020ffff -> 0x0020200000
[    0.092574] qcom-pcie 20000000.pci:      MEM 0x0020220000..0x002fffffff -> 0x0020220000
[    0.221993] qcom-pcie 20000000.pci: iATU unroll: enabled
[    0.222011] qcom-pcie 20000000.pci: Detected iATU regions: 8 outbound, 8 inbound
[    0.322076] qcom-pcie 20000000.pci: Link up
[    0.322228] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    0.322242] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.322261] pci_bus 0000:00: root bus resource [io  0x0000-0xffff] (bus address [0x20200000-0x2020ffff])
[    0.322274] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    0.322319] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400
[    0.322346] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.322430] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    0.325637] pci 0000:01:00.0: [168c:0050] type 00 class 0x028000
[    0.325785] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.326004] pci 0000:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    0.326464] pci 0000:01:00.0: supports D1
[    0.326475] pci 0000:01:00.0: PME# supported from D0 D1 D3hot
[    0.329519] pci 0000:00:00.0: BAR 8: assigned [mem 0x20300000-0x205fffff]
[    0.329541] pci 0000:00:00.0: BAR 9: assigned [mem 0x20600000-0x207fffff 64bit pref]
[    0.329556] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x20220fff]
[    0.329571] pci 0000:00:00.0: BAR 7: assigned [io  0x1000-0x1fff]
[    0.329588] pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[    0.329659] pci 0000:01:00.0: BAR 6: assigned [mem 0x20300000-0x2030ffff pref]
[    0.329673] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.329685] pci 0000:00:00.0:   bridge window [io  0x1000-0x1fff]
[    0.329698] pci 0000:00:00.0:   bridge window [mem 0x20300000-0x205fffff]
[    0.329711] pci 0000:00:00.0:   bridge window [mem 0x20600000-0x207fffff 64bit pref]
[    0.331648] pcieport 0000:00:00.0: PME: Signaling with IRQ 82
[    0.331953] pcieport 0000:00:00.0: AER: enabled with IRQ 82
[    0.335256] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[    0.335280] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[    0.339058] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.340701] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.340752] msm_serial 78b3000.serial: uartclk = 3686400
[    0.340811] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 22, base_baud = 230400) is a MSM
[    0.340850] msm_serial: console setup on port #0
[    1.163247] printk: console [ttyMSM0] enabled
[    1.168394] msm_serial: driver initialized
[    1.176464] loop: module loaded
[    1.176541] Loading iSCSI transport class v2.0-870.
[    1.181165] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xaa
[    1.184065] nand: ESMT GD9FS2G8F2A
[    1.190699] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    1.194165] 13 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.201467] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[    1.208390] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[    1.216575] Creating 13 MTD partitions on "qcom_nand.0":
[    1.223424] 0x000000000000-0x000000100000 : "0:sbl1"
[    1.230034] 0x000000100000-0x000000200000 : "0:mibib"
[    1.234964] 0x000000200000-0x000000500000 : "0:qsee"
[    1.241393] 0x000000500000-0x000000580000 : "0:devcfg"
[    1.244475] 0x000000580000-0x000000600000 : "0:rpm"
[    1.249427] 0x000000600000-0x000000680000 : "0:cdt"
[    1.254264] 0x000000680000-0x000000700000 : "0:appsblenv"
[    1.259065] 0x000000700000-0x000000800000 : "0:appsbl"
[    1.265035] 0x000000800000-0x000000880000 : "0:art"
[    1.269699] 0x000000880000-0x000000900000 : "bdata"
[    1.274450] 0x000000900000-0x000000a00000 : "pstore"
[    1.279688] 0x000000a00000-0x000002dc0000 : "ubi_kernel"
[    1.311618] 0x000002dc0000-0x000010000000 : "rootfs"
[    1.473626] mtd: setting mtd12 (rootfs) as root device
[    1.473919] mtdsplit: no squashfs found in "rootfs"
[    1.482146] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    1.485414] s1: supplied by regulator-dummy
[    1.488511] s2: supplied by regulator-dummy
[    1.492505] vdd_s3: supplied by regulator-dummy
[    1.496783] vdd_s4: supplied by regulator-dummy
[    1.501347] s5: supplied by regulator-dummy
[    1.505673] l1: supplied by regulator-dummy
[    1.509843] l2: supplied by regulator-dummy
[    1.514046] l3: supplied by regulator-dummy
[    1.518173] l4: supplied by regulator-dummy
[    1.522360] l5: supplied by regulator-dummy
[    1.526528] l6: supplied by regulator-dummy
[    1.530694] l7: supplied by regulator-dummy
[    1.534847] l8: supplied by regulator-dummy
[    1.539037] l9: supplied by regulator-dummy
[    1.543307] l11: supplied by regulator-dummy
[    1.547355] l12: supplied by regulator-dummy
[    1.551895] l13: supplied by regulator-dummy
[    1.569324] i2c_dev: i2c /dev entries driver
[    1.573354] sdhci: Secure Digital Host Controller Interface driver
[    1.573401] sdhci: Copyright(c) Pierre Ossman
[    1.578656] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.586524] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    1.590974] NET: Registered PF_INET6 protocol family
[    1.595388] Segment Routing with IPv6
[    1.599698] In-situ OAM (IOAM) with IPv6
[    1.603297] NET: Registered PF_PACKET protocol family
[    1.607258] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.612192] 8021q: 802.1Q VLAN Support v1.8
[    1.641388] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    1.641707] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    1.647514] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    1.654156] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    1.661785] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    1.669286] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.678427] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    1.685376] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 832000 uV
[    1.695358] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 888000 uV
[    1.705166] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 968000 uV
[    1.715028] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 714, quot_offset[ 7]=   0
[    1.724788] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 959, quot_offset[ 7]= 245
[    1.735638] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1052, quot_offset[ 7]=  90
[    1.746575] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1198, quot_offset[ 7]= 145
[    1.757647] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.759887] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 19200 KHz, changing to: 1017600 KHz[    1.776315] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    1.786361] ubi0: attaching mtd12
[    2.400448] random: crng init done
[    2.726886] ubi0: scanning is finished
[    2.733784] ubi0: attached mtd12 (name "rootfs", size 210 MiB)
[    2.733824] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.738517] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.745406] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.752242] ubi0: good PEBs: 1682, bad PEBs: 0, corrupted PEBs: 0
[    2.759003] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.765261] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1498686636
[    2.772383] ubi0: available PEBs: 0, total reserved PEBs: 1682, PEBs reserved for bad PEB handling: 40
[    2.781685] ubi0: background thread "ubi_bgt0d" started, PID 459
[    2.782540] block ubiblock0_0: created from ubi0:0(rootfs)
[    2.800572] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.801230] Freeing unused kernel memory: 1280K
[    2.870554] Run /sbin/init as init process
[    2.870575]   with arguments:
[    2.870578]     /sbin/init
[    2.870581]   with environment:
[    2.870584]     HOME=/
[    2.870586]     TERM=linux
[    2.870589]     uart_en=1
[    3.049277] init: Console is alive
[    3.049417] init: - watchdog -
[    3.627904] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.781066] ssdk_switch_device_num_init[1335]:INFO:ess-switch dts node number: 1
[    3.781191] ssdk_dt_get_switch_node[1124]:INFO:ess-switch DT exist!
[    3.787545] ssdk_dt_parse_access_mode[999]:INFO:switch_access_mode: local bus
[    3.793544] ssdk_dt_parse_access_mode[1012]:INFO:switchreg_base_addr: 0x3a000000
[    3.800829] ssdk_dt_parse_access_mode[1013]:INFO:switchreg_size: 0x1000000
[    3.808288] ssdk_dt_parse_mac_mode[327]:INFO:mac mode = 0x0
[    3.814975] ssdk_dt_parse_mac_mode[336]:INFO:mac mode1 = 0xff
[    3.820444] ssdk_dt_parse_mac_mode[345]:INFO:mac mode2 = 0xff
[    3.826399] ssdk_dt_parse_uniphy[364]:INFO:ess-uniphy DT exist!
[    3.832569] ssdk_dt_parse_intf_mac[942]:INFO:dp2 MAC 28:d1:27:fc:44:ae
[    3.837858] ssdk_dt_parse_intf_mac[942]:INFO:dp3 MAC 9c:9d:7e:75:57:88
[    3.844469] ssdk_dt_parse_intf_mac[942]:INFO:dp4 MAC 9c:9d:7e:75:57:88
[    3.850973] ssdk_dt_parse_intf_mac[942]:INFO:dp5 MAC 9c:9d:7e:75:57:88
[    3.857479] ssdk_plat_init[1692]:INFO:ssdk_plat_init start
[    3.982316] ssdk_gcc_clock_init[1275]:INFO:SSDK gcc clock init successfully!
[    3.983611] malibu_phy_api_ops_init[2846]:INFO:qca probe malibu phy driver succeeded!
[    3.988586] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    4.002160] regi_init[3953]:INFO:Initializing HPPE!!
[    4.240448] ssdk_ppe_reset_init[1535]:INFO:ppe reset successfully!
[    4.244046] qca_hppe_portctrl_hw_init[126]:INFO:Hawkeye PPE port initializing
[    4.245571] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    4.252864] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    4.486568] adpt_hppe_port_mux_mac_type_set[2787]:WARN:port 6 need not to configure mux and mac type
[    4.486633] ssdk_switch_register[2017]:INFO:Chip version 0x1500
[    4.494779] qca_link_polling_select[1487]:INFO:link-polling-required node does not exist
[    4.500402] ssdk_switch_register[2043]:INFO:polling is selected
[    4.508748] regi_init[3957]:INFO:Initializing HPPE Done!!
[    4.514463] ssdk_genl_init[211]:INFO:ssdk genl family register success.
[    4.519937] regi_init[4020]:INFO:qca-ssdk module init succeeded!
[    4.528854] EDMA ver 1 hw init
[    4.532844] EDMA HW Reset completed succesfully
[    4.535497] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    4.539893] RxDesc:1 (15-15) RxFill:1 (7-7)
[    4.545708] Generic PHY 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    4.549910] nss-dp 3a001200.dp2 wan: Registered netdev wan(qcom-id:2)
[    4.559392] Generic PHY 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    4.566077] nss-dp 3a001400.dp3 lan1: Registered netdev lan1(qcom-id:3)
[    4.575362] Generic PHY 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    4.582023] nss-dp 3a001600.dp4 lan2: Registered netdev lan2(qcom-id:4)
[    4.591501] Generic PHY 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=POLL)
[    4.598152] nss-dp 3a001800.dp5 lan3: Registered netdev lan3(qcom-id:5)
[    4.607483] **********************************************************
[    4.613694] * NSS Data Plane driver
[    4.620271] **********************************************************
[    4.631858] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.633207] init: - preinit -
[    7.110150] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    7.110279] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 634
[    7.144508] UBIFS (ubi0:1): recovery needed
[    7.231862] UBIFS (ubi0:1): recovery completed
[    7.231984] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    7.235204] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.243125] UBIFS (ubi0:1): FS size: 199479296 bytes (190 MiB, 1571 LEBs), max 1583 LEBs, journal size 10031104 bytes (9 MiB, 79 LEBs)
[    7.253017] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB)
[    7.264984] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 55C4C41A-BE5A-4D03-A402-D611ED1A3A05, small LPT model
[    7.275653] mount_root: switching to ubifs overlay
[    7.287437] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[    7.291614] urandom-seed: Seeding with /etc/urandom.seed
[    7.352937] procd: - early -
[    7.353044] procd: - watchdog -
[    7.899504] procd: - watchdog -
[    7.901310] procd: - ubus -
[    7.955427] procd: - init -
[    8.160085] urngd: v1.0.2 started.
[    8.176379] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.216105] Loading modules backported from Linux version v6.1-rc8-0-g76dcd734eca2
[    8.216147] Backport generated by backports.git v5.15.81-1-41-g02e352527db5
[    8.229898] NET: Registered PF_QIPCRTR protocol family
[    8.263137] PPP generic driver version 2.4.2
[    8.263989] NET: Registered PF_PPPOX protocol family
[    8.267992] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[    8.271469] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[    8.287784] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x50.
[    8.289166] ath10k_pci 0000:01:00.0: enabling device (0000 -> 0002)
[    8.297072] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[    9.070593] ath10k_pci 0000:01:00.0: qca9887 hw1.0 target 0x4100016d chip_id 0x004000ff sub 0000:0000
[    9.070651] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[    9.078957] ath10k_pci 0000:01:00.0: firmware ver 10.1-ct-87-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 61a92df5
[    9.114254] ath10k_pci 0000:01:00.0: Loading BDF type 0
[    9.134416] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id N/A crc32 b4ce36fa
[   10.001069] ath10k_pci 0000:01:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   10.007611] ath10k_pci 0000:01:00.0: wmi print 'P 128 V 8 T 410'
[   10.007659] ath10k_pci 0000:01:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   10.013847] ath10k_pci 0000:01:00.0: wmi print 'alloc rem: 25560 iram: 24780'
[   10.057872] ath10k_pci 0000:01:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal nvmem max-sta 128 raw 0 hwcrypto 1
[   10.058232] ath10k_pci 0000:01:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   10.171592] ath: EEPROM regdomain: 0x0
[   10.171602] ath: EEPROM indicates default country code should be used
[   10.171605] ath: doing EEPROM country->regdmn map search
[   10.171610] ath: country maps to regdmn code: 0x3a
[   10.171614] ath: Country alpha2 being used: US
[   10.171618] ath: Regpair used: 0x3a
[   10.182577] ath11k c000000.wifi: ipq8074 hw2.0
[   10.182615] ath11k c000000.wifi: FW memory mode: 1
[   10.186232] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   10.190906] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   11.378768] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   11.380106] ath11k c000000.wifi: qmi ignore invalid mem req type 3
[   11.385814] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   11.391279] ath11k c000000.wifi: fw_version 0x250a04a5 fw_build_timestamp 2021-12-20 07:09 fw_build_id WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
[   11.402764] kmodloader: done loading kernel modules from /etc/modules.d/*
[   13.724267] br-lan: port 1(lan1) entered blocking state
[   13.724315] br-lan: port 1(lan1) entered disabled state
[   13.728557] device lan1 entered promiscuous mode
[   13.742598] br-lan: port 2(lan2) entered blocking state
[   13.742651] br-lan: port 2(lan2) entered disabled state
[   13.746902] device lan2 entered promiscuous mode
[   13.755562] br-lan: port 3(lan3) entered blocking state
[   13.756717] br-lan: port 3(lan3) entered disabled state
[   13.762029] device lan3 entered promiscuous mode
[   13.772444] nss-dp 3a001200.dp2 wan: PHY Link up speed: 1000
[   14.177376] ath: EEPROM regdomain: 0x8210
[   14.177431] ath: EEPROM indicates we should expect a country code
[   14.177467] ath11k c000000.wifi: No regulatory rules available in the event info
[   14.180392] ath: doing EEPROM country->regdmn map search
[   14.180396] ath: country maps to regdmn code: 0x37
[   14.180399] ath: Country alpha2 being used: NL
[   14.180403] ath: Regpair used: 0x37
[   14.180405] ath: regdomain 0x8210 dynamically updated by user
[   14.186502] ath11k c000000.wifi: failed to extract regulatory info from received event
[   14.186549] ------------[ cut here ]------------
[   14.225351] WARNING: CPU: 0 PID: 2498 at ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.230136] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath11k_ahb ath11k ath10k_pci ath10k_core ath wireguard pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 libchacha20poly1305 chacha_neon cfg80211 slhc qrtr_smd qrtr qmi_helpers poly1305_neon ns nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcurve25519_generic libcrc32c libchacha hwmon crc_ccitt compat ip6_udp_tunnel udp_tunnel seqiv jitterentropy_rng drbg michael_mic kpp hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp qca_ssdk gpio_button_hotplug crc32c_generic
[   14.295827] CPU: 0 PID: 2498 Comm: iw Not tainted 5.15.98 #0
[   14.318060] Hardware name: Xiaomi AX3600 (DT)
[   14.323874] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   14.328131] pc : ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.334903] lr : ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.342195] sp : ffffffc008003c20
[   14.349478] x29: ffffffc008003c20 x28: 0000000000000044 x27: ffffffc008be6810
[   14.352957] x26: 000000000000004c x25: 000000000000000a x24: 0000000000000000
[   14.360075] x23: 0000000000000000 x22: ffffff8003e0c000 x21: ffffff8005b7ed00
[   14.367193] x20: ffffff8004520000 x19: ffffff8003e02600 x18: fffffffffffe5df8
[   14.374312] x17: 20746e6576652065 x16: 6874206e6920656c x15: fffffffffffe5e50
[   14.381430] x14: 0000000000000001 x13: 0a746e6576652064 x12: 6576696563657220
[   14.388548] x11: 6d6f7266206f666e x10: 692079726f74616c x9 : 666e692079726f74
[   14.395666] x8 : 616c756765722074 x7 : ffffffc008b81c98 x6 : 0000000000000001
[   14.402783] x5 : ffffff801fe966e0 x4 : 0000000000000000 x3 : 0000000000000000
[   14.409901] x2 : 0000000000000000 x1 : ffffff800281de00 x0 : 000000000000004a
[   14.417021] Call trace:
[   14.424130]  ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.426395]  ath11k_htc_rx_completion_handler+0x464/0x610 [ath11k]
[   14.433337]  ath11k_ce_per_engine_service+0x2e0/0x3f0 [ath11k]
[   14.439586]  0xffffffc000b8fc74
[   14.445397]  tasklet_action_common.constprop.0+0x144/0x180
[   14.448440]  tasklet_action+0x28/0x34
[   14.453992]  _stext+0x10c/0x28c
[   14.457723]  irq_exit+0xbc/0x100
[   14.460675]  handle_domain_irq+0x64/0x90
[   14.464150]  gic_handle_irq+0x74/0xa0
[   14.468055]  call_on_irq_stack+0x28/0x54
[   14.471615]  do_interrupt_handler+0x54/0x60
[   14.475607]  el0_interrupt+0x74/0xc0
[   14.479512]  __el0_irq_handler_common+0x18/0x24
[   14.483334]  el0t_64_irq_handler+0x10/0x1c
[   14.487586]  el0t_64_irq+0x184/0x188
[   14.491753] ---[ end trace b56c3b484bbeec0f ]---
[   14.496968] ath11k c000000.wifi: No regulatory rules available in the event info
[   14.500115] ath11k c000000.wifi: failed to extract regulatory info from received event
[   14.507535] ------------[ cut here ]------------
[   14.515192] WARNING: CPU: 0 PID: 0 at ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.519976] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath11k_ahb ath11k ath10k_pci ath10k_core ath wireguard pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 libchacha20poly1305 chacha_neon cfg80211 slhc qrtr_smd qrtr qmi_helpers poly1305_neon ns nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcurve25519_generic libcrc32c libchacha hwmon crc_ccitt compat ip6_udp_tunnel udp_tunnel seqiv jitterentropy_rng drbg michael_mic kpp hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp qca_ssdk gpio_button_hotplug crc32c_generic
[   14.585408] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         5.15.98 #0
[   14.607646] Hardware name: Xiaomi AX3600 (DT)
[   14.615192] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   14.619450] pc : ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.626222] lr : ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.633512] sp : ffffffc008003c20
[   14.640796] x29: ffffffc008003c20 x28: 0000000000000044 x27: ffffffc008be6810
[   14.644277] x26: 0000000000000018 x25: 000000000000000d x24: 0000000000000000
[   14.651395] x23: 0000000000000000 x22: ffffff8003e0c000 x21: ffffff8005b7eb80
[   14.658513] x20: ffffff8004520000 x19: ffffff8003e02700 x18: ffffffc008b27bc8
[   14.665630] x17: 65636572206d6f72 x16: 66206f666e692079 x15: 0000000000000492
[   14.672749] x14: 0000000000000186 x13: ffffffc008003818 x12: ffffffc008b7fbc8
[   14.679866] x11: 0000000000000004 x10: ffffffc008b7fbc8 x9 : 0000000000000000
[   14.686986] x8 : ffffffc008b27b78 x7 : ffffffc008b27bc8 x6 : 0000000000000001
[   14.694104] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[   14.701220] x2 : 0000000000000000 x1 : ffffffc008b1e100 x0 : 000000000000004a
[   14.708340] Call trace:
[   14.715450]  ath11k_hal_rx_sw_mon_ring_buf_paddr_get+0x3194/0x49f0 [ath11k]
[   14.717714]  ath11k_htc_rx_completion_handler+0x464/0x610 [ath11k]
[   14.724657]  ath11k_ce_per_engine_service+0x2e0/0x3f0 [ath11k]
[   14.730906]  0xffffffc000b8fc74
[   14.736716]  tasklet_action_common.constprop.0+0x144/0x180
[   14.739759]  tasklet_action+0x28/0x34
[   14.745313]  _stext+0x10c/0x28c
[   14.749044]  irq_exit+0xbc/0x100
[   14.751996]  handle_domain_irq+0x64/0x90
[   14.755470]  gic_handle_irq+0x74/0xa0
[   14.759376]  call_on_irq_stack+0x28/0x54
[   14.762935]  do_interrupt_handler+0x54/0x60
[   14.766928]  el1_interrupt+0x30/0x50
[   14.770832]  el1h_64_irq_handler+0x18/0x24
[   14.774652]  el1h_64_irq+0x78/0x7c
[   14.778557]  arch_cpu_idle+0x18/0x2c
[   14.781943]  default_idle_call+0x20/0x70
[   14.785677]  do_idle+0x214/0x240
[   14.789581]  cpu_startup_entry+0x28/0x60
[   14.790487] IPv6: ADDRCONF(NETDEV_CHANGE): wan: link becomes ready
[   14.792794]  rest_init+0xc8/0xe0
[   14.802690]  arch_call_rest_init+0x10/0x1c
[   14.806076]  start_kernel+0x6a8/0x6cc
[   14.809981]  __primary_switched+0xa0/0xa8

Any idea?
Thanks

Long shot, but try changing your country code from NL to something else. It looks like its complaining something about the wifi regulatory db.

I am running 2 AX3600s no problem. Mind you a tiny bit older build than you, snapshot r22151.

What does your /proc/mtd look like?

Here is mine:

dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00300000 00020000 "0:qsee"
mtd3: 00080000 00020000 "0:devcfg"
mtd4: 00080000 00020000 "0:rpm"
mtd5: 00080000 00020000 "0:cdt"
mtd6: 00080000 00020000 "0:appsblenv"
mtd7: 00100000 00020000 "0:appsbl"
mtd8: 00080000 00020000 "0:art"
mtd9: 00080000 00020000 "bdata"
mtd10: 00100000 00020000 "pstore"
mtd11: 023c0000 00020000 "ubi_kernel"
mtd12: 0d240000 00020000 "rootfs"

it had the same problem on all the builds downloaded from openwrt. since when I installed it.
the mtd are like yours.

dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00300000 00020000 "0:qsee"
mtd3: 00080000 00020000 "0:devcfg"
mtd4: 00080000 00020000 "0:rpm"
mtd5: 00080000 00020000 "0:cdt"
mtd6: 00080000 00020000 "0:appsblenv"
mtd7: 00100000 00020000 "0:appsbl"
mtd8: 00080000 00020000 "0:art"
mtd9: 00080000 00020000 "bdata"
mtd10: 00100000 00020000 "pstore"
mtd11: 023c0000 00020000 "ubi_kernel"
mtd12: 0d240000 00020000 "rootfs"

I changed country to US..same.... to "driver default"... same.
looks like the radio sends something to the driver which it doesn't like.
can you please output the result of

dmesg | grep fw_version

[   11.222382] ath11k c000000.wifi: fw_version 0x250a04a5 fw_build_timestamp 2021-12-20 07:09 fw_build_id WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1

Seems weird to me that I have an HK firmware version on the radio (since it's an european model).
Maybe did it get downgraded when I downgraded the original firmware to root the device and that version is buggy?

...also....the ATK10/QCA9887 card works just fine.

Mine is EU model too btw, same dmesg dump as you:

[ 9.415139] ath11k c000000.wifi: fw_version 0x250a04a5 fw_build_timestamp 2021-12-20 07:09 fw_build_id WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1

Would you mind sharing your working configuration, please?
This is mine:

uci show wireless
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.path='soc/20000000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
wireless.radio0.band='5g'
wireless.radio0.country='NL'
wireless.radio0.cell_density='0'
wireless.radio0.channel='124'
wireless.radio0.htmode='VHT80'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.encryption='sae-mixed'
wireless.default_radio0.key='redacted'
wireless.default_radio0.ssid='redacted'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='platform/soc/c000000.wifi'
wireless.radio1.band='5g'
wireless.radio1.cell_density='0'
wireless.radio1.htmode='HE160'
wireless.radio1.channel='auto'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.encryption='sae-mixed'
wireless.default_radio1.key='redacted'
wireless.default_radio1.ssid='redacted'
wireless.radio2=wifi-device
wireless.radio2.type='mac80211'
wireless.radio2.path='platform/soc/c000000.wifi+1'
wireless.radio2.band='2g'
wireless.radio2.cell_density='0'
wireless.radio2.htmode='HE40'
wireless.radio2.channel='auto'
wireless.default_radio2=wifi-iface
wireless.default_radio2.device='radio2'
wireless.default_radio2.network='lan'
wireless.default_radio2.mode='ap'
wireless.default_radio2.encryption='sae-mixed'
wireless.default_radio2.key='redacted'
wireless.default_radio2.ssid='redacted'

Only things different to my radio1 config are auto channel, htmode and country setting.

I upgrade my two ax3600 with todays snapshot and both are working fine.
Can you try HE80 instead of HE160?

Confirmed: with HT80 it works....
The driver crashes anyway (in dmesg) but at least the wifi is there.
This approach basically uses the radio in AC mode and not in AX.... which is the reason someone buys a WiFi 6 modem... is there a way to update the driver?

Care to explain your approach?

just follow the procedure in the wiki

wrong. ax will be ax not dependent on he80 or he160.

In the Luci interface this is what it seems.
When I change to HE80 luci changes automatically to AC (and the other way around, if i put AX it changes to 160)...

if i change it via luci and select ac 80 it gets VHT80. If i select AX 80 it gets HE80.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.