OpenWrt support for Linksys MX6200

have tried with multiple fw versions too, same results.

bootlog
\[    0.000000\] Booting Linux on physical CPU 0x0000000000 \[0x51af8014\]
\[    0.000000\] Linux version 6.12.54 (george@sl2-ubuntu) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r30807+6-4d3a35f36891) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Sun Oct 26 08:37:39 2025
\[    0.000000\] Machine model: Linksys MX6200
\[    0.000000\] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
\[    0.000000\] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
\[    0.000000\] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
\[    0.000000\] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
\[    0.000000\] OF: reserved mem: 0x000000004b000000..0x000000004fcfffff (78848 KiB) nomap non-reusable wcss@4b000000
\[    0.000000\] Zone ranges:
\[    0.000000\]   DMA      \[mem 0x0000000040000000-0x000000005fffffff\]
\[    0.000000\]   DMA32    empty
\[    0.000000\]   Normal   empty
\[    0.000000\] Movable zone start for each node
\[    0.000000\] Early memory node ranges
\[    0.000000\]   node   0: \[mem 0x0000000040000000-0x000000004a3fffff\]
\[    0.000000\]   node   0: \[mem 0x000000004a400000-0x000000004a9fffff\]
\[    0.000000\]   node   0: \[mem 0x000000004aa00000-0x000000004aafffff\]
\[    0.000000\]   node   0: \[mem 0x000000004ab00000-0x000000004adfffff\]
\[    0.000000\]   node   0: \[mem 0x000000004ae00000-0x000000004affffff\]
\[    0.000000\]   node   0: \[mem 0x000000004b000000-0x000000004fcfffff\]
\[    0.000000\]   node   0: \[mem 0x000000004fd00000-0x000000005fffffff\]
\[    0.000000\] Initmem setup node 0 \[mem 0x0000000040000000-0x000000005fffffff\]
\[    0.000000\] psci: probing for conduit method from DT.
\[    0.000000\] psci: PSCIv1.0 detected in firmware.
\[    0.000000\] psci: Using standard PSCI v0.2 function IDs
\[    0.000000\] psci: MIGRATE_INFO_TYPE not supported.
\[    0.000000\] psci: SMC Calling Convention v1.0
\[    0.000000\] psci: OSI mode supported.
\[    0.000000\] psci: \[Firmware Bug\]: failed to set PC mode: -1
\[    0.000000\] percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920
\[    0.000000\] pcpu-alloc: s43224 r8192 d30504 u81920 alloc=20*4096
\[    0.000000\] pcpu-alloc: \[0\] 0 \[0\] 1
\[    0.000000\] Detected VIPT I-cache on CPU0
\[    0.000000\] CPU features: detected: Spectre-v4
\[    0.000000\] alternatives: applying boot alternatives
\[    0.000000\] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_0 coherent_pool=2M
\[    0.000000\] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
\[    0.000000\] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
\[    0.000000\] Built 1 zonelists, mobility grouping on.  Total pages: 131072
\[    0.000000\] mem auto-init: stack:off, heap alloc:off, heap free:off
\[    0.000000\] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
\[    0.000000\] software IO TLB: area num 2.
\[    0.000000\] software IO TLB: mapped \[mem 0x000000005f580000-0x000000005f600000\] (0MB)
\[    0.000000\] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
\[    0.000000\] rcu: Hierarchical RCU implementation.
\[    0.000000\] rcu: 	RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
\[    0.000000\] 	Tracing variant of Tasks RCU enabled.
\[    0.000000\] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
\[    0.000000\] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
\[    0.000000\] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
\[    0.000000\] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
\[    0.000000\] Root IRQ handler: gic_handle_irq
\[    0.000000\] GICv2m: range\[mem 0x0b00a000-0x0b00aff7\], SPI\[448:479\]
\[    0.000000\] GICv2m: range\[mem 0x0b00b000-0x0b00bff7\], SPI\[480:511\]
\[    0.000000\] rcu: srcu_init: Setting srcu_struct sizes based on contention.
\[    0.000000\] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
\[    0.000000\] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
\[    0.000001\] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
\[    0.000122\] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
\[    0.000139\] pid_max: default: 32768 minimum: 301
\[    0.005080\] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
\[    0.005103\] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
\[    0.011464\] rcu: Hierarchical SRCU implementation.
\[    0.011479\] rcu: 	Max phase no-delay instances is 1000.
\[    0.012002\] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
\[    0.012618\] smp: Bringing up secondary CPUs ...
\[    0.013694\] Detected VIPT I-cache on CPU1
\[    0.013843\] CPU1: Booted secondary processor 0x0000000001 \[0x51af8014\]
\[    0.014069\] smp: Brought up 1 node, 2 CPUs
\[    0.014088\] SMP: Total of 2 processors activated.
\[    0.014093\] CPU: All CPU(s) started at EL1
\[    0.014099\] CPU features: detected: 32-bit EL0 Support
\[    0.014106\] CPU features: detected: CRC32 instructions
\[    0.014184\] alternatives: applying system-wide alternatives
\[    0.014428\] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
\[    0.014682\] Memory: 401316K/524288K available (8704K kernel code, 900K rwdata, 2764K rodata, 9472K init, 287K bss, 121128K reserved, 0K cma-reserved)
\[    0.021770\] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
\[    0.021806\] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
\[    0.021939\] 27184 pages in range for non-PLT usage
\[    0.021947\] 518704 pages in range for PLT usage
\[    0.024106\] pinctrl core: initialized pinctrl subsystem
\[    0.026797\] NET: Registered PF_NETLINK/PF_ROUTE protocol family
\[    0.027820\] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
\[    0.028172\] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
\[    0.028507\] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
\[    0.029094\] thermal_sys: Registered thermal governor 'step_wise'
\[    0.029299\] cpuidle: using governor menu
\[    0.029602\] ASID allocator initialised with 65536 entries
\[    0.034918\] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
\[    0.075174\] SCSI subsystem initialized
\[    0.075560\] usbcore: registered new interface driver usbfs
\[    0.075617\] usbcore: registered new interface driver hub
\[    0.075711\] usbcore: registered new device driver usb
\[    0.076104\] qcom_scm: convention: smc arm 64
\[    0.078846\] clocksource: Switched to clocksource arch_sys_counter
\[    0.083026\] NET: Registered PF_INET protocol family
\[    0.083299\] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
\[    0.085505\] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
\[    0.085543\] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
\[    0.085569\] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
\[    0.085625\] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
\[    0.085805\] TCP: Hash tables configured (established 4096 bind 4096)
\[    0.086411\] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
\[    0.086632\] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
\[    0.086670\] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
\[    0.087221\] NET: Registered PF_UNIX/PF_LOCAL protocol family
\[    0.087286\] PCI: CLS 0 bytes, default 64
\[    0.099122\] workingset: timestamp_bits=46 max_order=17 bucket_order=0
\[    0.100080\] squashfs: version 4.0 (2009/01/31) Phillip Lougher
\[    0.100114\] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
\[    0.121774\] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
\[    0.123756\] msm_serial 78af000.serial: msm_serial: detected port* #0\*
\[    0.123907\] msm_serial 78af000.serial: uartclk = 1843199
\[    0.124683\] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
\[    0.124831\] msm_serial: console setup on port\* #0\*
\[    0.124901\] printk: legacy console \[ttyMSM0\] enabled
\[    0.847549\] msm_serial: driver initialized
\[    0.863609\] loop: module loaded
\[    0.872146\] spi-nand spi0.0: GigaDevice SPI NAND was found.
\[    0.872210\] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
\[    1.015007\] 24 fixed-partitions partitions found on MTD device spi0.0
\[    1.015077\] Creating 24 MTD partitions on "spi0.0":
\[    1.020512\] 0x000000000000-0x000000100000 : "0:SBL1"
\[    1.027900\] 0x000000100000-0x000000200000 : "0:MIBIB"
\[    1.033618\] 0x000000200000-0x000000240000 : "0:BOOTCONFIG"
\[    1.036849\] 0x000000240000-0x000000280000 : "0:BOOTCONFIG1"
\[    1.042356\] 0x000000280000-0x000000480000 : "0:QSEE"
\[    1.050726\] 0x000000480000-0x000000680000 : "0:QSEE_1"
\[    1.055685\] 0x000000680000-0x000000780000 : "0:DEVCFG"
\[    1.059942\] 0x000000780000-0x000000880000 : "0:DEVCFG_1"
\[    1.064389\] 0x000000880000-0x000000980000 : "0:CDT"
\[    1.069957\] 0x000000980000-0x000000a80000 : "0:CDT_1"
\[    1.074376\] 0x000000a80000-0x000000b80000 : "ppinfo"
\[    1.079572\] 0x000000b80000-0x000000e00000 : "0:APPSBL"
\[    1.086666\] 0x000000e00000-0x000001080000 : "0:APPSBL_1"
\[    1.091915\] 0x000001080000-0x000001280000 : "0:ART"
\[    1.096314\] 0x000001280000-0x000001380000 : "0:TRAINING"
\[    1.099741\] 0x000001380000-0x000001480000 : "u_env"
\[    1.104977\] 0x000001480000-0x000001580000 : "s_env"
\[    1.109801\] 0x000001580000-0x000001680000 : "devinfo"
\[    1.115003\] 0x000001680000-0x000004880000 : "kernel"
\[    1.196436\] 0x000001e80000-0x000004880000 : "rootfs"
\[    1.197591\] mtd: setting mtd19 (rootfs) as root device
\[    1.201205\] mtdsplit: no squashfs found in "rootfs"
\[    1.205477\] 0x000004880000-0x000007a80000 : "alt_kernel"
\[    1.291003\] 0x000005080000-0x000007a80000 : "alt_rootfs"
\[    1.292176\] 0x000007a80000-0x000007c80000 : "sysdiag"
\[    1.299998\] 0x000007c80000-0x00000fe80000 : "syscfg"
\[    1.690674\] Maxlinear Ethernet GPY115C 90000.mdio-1:0f: Firmware Version: 8.111 (0x886F)
\[    1.692241\] i2c_dev: i2c /dev entries driver
\[    1.702802\] sdhci: Secure Digital Host Controller Interface driver
\[    1.702858\] sdhci: Copyright(c) Pierre Ossman
\[    1.708106\] sdhci-pltfm: SDHCI platform and OF driver helper
\[    1.716387\] remoteproc remoteproc0: releasing cd00000.remoteproc
\[    1.965947\] NET: Registered PF_INET6 protocol family
\[    1.967772\] Segment Routing with IPv6
\[    1.970098\] In-situ OAM (IOAM) with IPv6
\[    1.973652\] NET: Registered PF_PACKET protocol family
\[    1.977926\] 8021q: 802.1Q VLAN Support v1.8
\[    2.029185\] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
\[    2.032280\] remoteproc remoteproc0: cd00000.remoteproc is available
\[    2.039143\] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
\[    2.046398\] remoteproc remoteproc1: pd-1 is available
\[    2.050658\] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
\[    2.057125\] remoteproc remoteproc2: pd-2 is available
\[    2.061207\] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
\[    2.067744\] remoteproc remoteproc3: pd-3 is available
\[    2.073887\] clk: Disabling unused clocks
\[    2.083644\] Freeing unused kernel memory: 9472K
\[    2.083929\] Run /init as init process
\[    2.087002\]   with arguments:
\[    2.087008\]     /init
\[    2.087013\]   with environment:
\[    2.087018\]     HOME=/
\[    2.087023\]     TERM=linux
\[    2.616918\] init: Console is alive
\[    2.617288\] init: - watchdog -
\[    2.634208\] kmodloader: loading kernel modules from /etc/modules-boot.d/\*
\[    2.660019\] gpio_button_hotplug: loading out-of-tree module taints kernel.
\[    2.676832\] ssdk_dt_parse_mac_mode\[300\]:INFO:mac mode1 doesn't exit!
\[    2.676884\] ssdk_dt_parse_mac_mode\[308\]:INFO:mac mode2 doesn't exit!
\[    2.682478\] ssdk_dt_parse_port_bmp\[1064\]:INFO:port_bmp doesn't exist!
\[    2.688619\] ssdk_dt_parse_interrupt\[942\]:INFO:intr-gpio does not exist
\[    4.198923\] ssdk_mp_reset_init\[1311\]:INFO:MP reset successfully!
\[    4.200095\] ssdk_phy_driver_init\[341\]:INFO:dev_id = 0, phy_adress = 271, phy_id = 0xfffafffa phytype doesn't match
\[    4.532899\] regi_init\[2548\]:INFO:Initializing SCOMPHY Done!!
\[    4.533085\] regi_init\[2574\]:INFO:qca-ssdk module init succeeded!
\[    4.541730\] nss-dp 39c00000.dp1 lan (uninitialized): nss_dp_gmac: Registering netdev lan(qcom-id:1) with GMAC, mac_base: 0xffffffc081f20000
\[    4.609842\] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
\[    4.613488\] nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc081f50000
\[    4.621594\] Maxlinear Ethernet GPY115C 90000.mdio-1:0f: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:0f, irq=POLL)
\[    4.635218\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
\[    4.644174\] \* NSS Data Plane driver
\[    4.650464\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
\[    4.671155\] kmodloader: done loading kernel modules from /etc/modules-boot.d/\*
\[    4.681846\] init: - preinit -
\[    6.788845\] random: crng init done
\[   11.209375\] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
\[   11.283696\] nss-dp 39c00000.dp1 lan: PHY Link is down
\[   11.291888\] procd: - early -
\[   11.292134\] procd: - watchdog -
\[   11.922796\] procd: - watchdog -
\[   11.923213\] procd: - ubus -
\[   11.981086\] procd: - init -
\[   12.392571\] kmodloader: loading kernel modules from /etc/modules.d/\*
\[   12.641455\] Loading modules backported from Linux version v6.16-0-g038d61fd6422
\[   12.641502\] Backport generated by backports.git v6.1.145-1-47-g6194bf852a3e
\[   12.677280\] NET: Registered PF_QIPCRTR protocol family
\[   12.759238\] urngd: v1.0.2 started.
\[   12.863478\] PPP generic driver version 2.4.2
\[   12.867245\] NET: Registered PF_PPPOX protocol family
\[   12.908969\] ath11k c000000.wifi: ipq5018 hw1.0
\[   12.909042\] ath11k c000000.wifi: FW memory mode: 1
\[   13.030268\] remoteproc remoteproc1: powering up pd-1
\[   13.030496\] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
\[   13.034329\] remoteproc remoteproc0: powering up cd00000.remoteproc
\[   13.042857\] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
\[   13.183798\] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
\[   13.203888\] remoteproc remoteproc1: remote processor pd-1 is now up
\[   13.208013\] ath11k b00a040.wifi: Multipd architecture - userpd: 1
\[   13.209821\] ath11k b00a040.wifi: qcn6122 hw1.0
\[   13.215226\] ath11k b00a040.wifi: FW memory mode: 1
\[   13.232100\] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
\[   13.239669\] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
\[   13.239741\] ath11k c000000.wifi: fw_version 0x280e7fff fw_build_timestamp 2024-05-28 17:56 fw_build_id WLAN.HK.2.8-01357-QCAHKSWPL_SILICONZ-1.45329.1.71292.1
\[   13.290254\] remoteproc remoteproc2: powering up pd-2
\[   13.290605\] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
\[   13.305289\] remoteproc remoteproc2: remote processor pd-2 is now up
\[   13.306805\] ath11k b00b040.wifi: Multipd architecture - userpd: 2
\[   13.311780\] ath11k b00b040.wifi: qcn6122 hw1.0
\[   13.316650\] ath11k b00b040.wifi: FW memory mode: 1
\[   13.386417\] ath11k b00a040.wifi: qmi ignore invalid mem req type 10
\[   13.393778\] ath11k b00a040.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
\[   13.393850\] ath11k b00a040.wifi: fw_version 0x280e7fff fw_build_timestamp 2024-05-28 17:56 fw_build_id WLAN.HK.2.8-01357-QCAHKSWPL_SILICONZ-1.45329.1.71292.1
\[   13.424733\] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
\[   14.886505\] remoteproc remoteproc3: powering up pd-3
\[   14.886820\] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
\[   14.902395\] remoteproc remoteproc3: remote processor pd-3 is now up
\[   14.914117\] batman_adv: B.A.T.M.A.N. advanced 2025.3-openwrt-1 (compatibility version 15) loaded
\[   14.923951\] kmodloader: done loading kernel modules from /etc/modules.d/\*
\[   14.998605\] ath11k b00b040.wifi: qmi ignore invalid mem req type 10
\[   15.006146\] ath11k b00b040.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
\[   15.006217\] ath11k b00b040.wifi: fw_version 0x280e7fff fw_build_timestamp 2024-05-28 17:56 fw_build_id WLAN.HK.2.8-01357-QCAHKSWPL_SILICONZ-1.45329.1.71292.1
\[   15.028189\] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
\[   15.039797\] ath11k c000000.wifi: htt event 48 not handled
\[   16.777455\] ath11k b00a040.wifi: htt event 48 not handled
\[   16.871354\] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
\[   19.218942\] ath11k b00b040.wifi: htt event 48 not handled
\[   23.921776\] br-lan: port 1(lan) entered blocking state
\[   23.921852\] br-lan: port 1(lan) entered disabled state
\[   23.926074\] nss-dp 39c00000.dp1 lan: entered allmulticast mode
\[   23.939954\] nss-dp 39c00000.dp1 lan: entered promiscuous mode
\[   27.049864\] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
\[   27.050166\] br-lan: port 1(lan) entered blocking state
\[   27.054623\] br-lan: port 1(lan) entered forwarding state
\[  114.074807\] br-lan: port 2(phy2-ap0) entered blocking state
\[  114.074894\] br-lan: port 2(phy2-ap0) entered disabled state
\[  114.080379\] ath11k b00b040.wifi phy2-ap0: entered allmulticast mode
\[  114.086466\] ath11k b00b040.wifi phy2-ap0: entered promiscuous mode
\[  114.576685\] br-lan: port 2(phy2-ap0) entered blocking state
\[  114.576770\] br-lan: port 2(phy2-ap0) entered forwarding state
iwinfo phy2-ap0
phy2-ap0 ESSID: "OpenWrt-6G"
Access Point: 80:69:1a:7d:7d:ba
Mode: Master  Channel: 21 (6.055 GHz)  HT Mode: HE80
Center Channel 1: 23 2: unknown
Tx-Power: 0 dBm  Link Quality: 70/70
Signal: 0 dBm  Noise: -106 dBm
Bit Rate: unknown
Encryption: SAE (CCMP)
Type: nl80211  HW Mode(s): 802.11ax
Hardware: nl80211 \[Generic MAC80211\]
TX power offset: none
Channel offset: none
Supports VAPs: yes  PHY name: phy2
cat /etc/config/wireless
config wifi-device 'radio2'
option type 'mac80211'
option path 'platform/soc@0/b00b040.wifi'
option band '6g'
option channel '21'
option htmode 'HE80'
option country 'US'
option cell_density '0'

config wifi-iface 'default_radio2'
option device 'radio2'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt-6G'
option encryption 'sae'
option key 'test1234'
option ocv '0'
logread
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Set MLD config: [ ]
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Reload all interfaces
Thu Jan  1 00:01:53 1970 daemon.notice wpa_supplicant\[2164\]: Set MLD config: [ ]
Thu Jan  1 00:01:53 1970 daemon.notice netifd: radio2 (3887): wifi-scripts: Starting
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Set MLD config: [ ]
Thu Jan  1 00:01:53 1970 daemon.notice wpa_supplicant\[2164\]: Set MLD config: [ ]
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Reload all interfaces
Thu Jan  1 00:01:53 1970 daemon.notice netifd: radio2 (3887): command failed: Not supported (-95)
Thu Jan  1 00:01:53 1970 daemon.notice wpa_supplicant\[2164\]: Set new config for phy phy2
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Set new config for phy phy2: /var/run/hostapd-phy2.conf
Thu Jan  1 00:01:53 1970 daemon.notice hostapd: Restart interface for phy phy2
Thu Jan  1 00:01:54 1970 daemon.notice hostapd: Configuration file:  (phy phy2) --> new PHY
Thu Jan  1 00:01:54 1970 daemon.notice hostapd: Configuration file: Reading configuration file ''
Thu Jan  1 00:01:54 1970 daemon.notice hostapd: Configuration file: Reading configuration file ''
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.074807\] br-lan: port 2(phy2-ap0) entered blocking state
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.074894\] br-lan: port 2(phy2-ap0) entered disabled state
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.080379\] ath11k b00b040.wifi phy2-ap0: entered allmulticast mode
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.086466\] ath11k b00b040.wifi phy2-ap0: entered promiscuous mode
Thu Jan  1 00:01:54 1970 daemon.notice hostapd: phy2-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.576685\] br-lan: port 2(phy2-ap0) entered blocking state
Thu Jan  1 00:01:54 1970 kern.info kernel: \[  114.576770\] br-lan: port 2(phy2-ap0) entered forwarding state
Thu Jan  1 00:01:54 1970 daemon.notice netifd: Network device 'phy2-ap0' link is up
Thu Jan  1 00:01:55 1970 daemon.notice hostapd: phy2-ap0: interface state COUNTRY_UPDATE->ENABLED
Thu Jan  1 00:01:55 1970 daemon.notice hostapd: phy2-ap0: AP-ENABLED
Thu Jan  1 00:01:55 1970 daemon.notice netifd: radio2 (3887): wifi-scripts: Configuring 'phy2' txantenna: 4294967295, rxantenna: 4294967295 distance: 0
Thu Jan  1 00:01:55 1970 daemon.notice netifd: radio2 (3887): wifi-scripts: Preparing interface: phy2-ap0 with MAC: 80:69:1a:7d:7d:ba
Thu Jan  1 00:01:55 1970 daemon.notice wpa_supplicant\[2164\]: Start pending MLD interfaces

Ignore this for now, it’s known issue not limited to Qualcomm: https://github.com/openwrt/openwrt/issues/16548

Is the 6GHz network visible on the same client on OEM firmware?

Also try setting one of the PSC channels above 33.

How you managed get 3rd wifi up? Have you tested single adapter? in below case scr50axe 2.4+6ghz is working just with simple 'sae-mixed' encryption added

iwinfo

root@OpenWrt:~# iwinfo
phy0-ap0 ESSID: "OpenWrt"
Access Point: F4:4D:5C:5A:05:E3
Mode: Master Channel: 1 (2.412 GHz) HT Mode: HE20
Center Channel 1: 1 2: unknown
Tx-Power: 23 dBm Link Quality: unknown/70
Signal: unknown Noise: -103 dBm
Bit Rate: unknown
Encryption: none
Type: nl80211 HW Mode(s): 802.11ax/b/g/n
Hardware: embedded [Qualcomm Atheros IPQ5018]
TX power offset: none
Frequency offset: none
Supports VAPs: yes PHY name: phy0

phy1-ap0 ESSID: "OpenWrt6"
Access Point: F4:4D:5C:5A:05:E4
Mode: Master Channel: 1 (5.955 GHz) HT Mode: HE80
Center Channel 1: 7 2: unknown
Tx-Power: 20 dBm Link Quality: unknown/70
Signal: unknown Noise: -108 dBm
Bit Rate: unknown
Encryption: WPA3 SAE (CCMP)
Type: nl80211 HW Mode(s): 802.11ax
Hardware: embedded [Qualcomm Atheros QCN6102/QCN6122]
TX power offset: none
Frequency offset: none
Supports VAPs: yes PHY name: phy1

yes, it is visible, even on low PSC channels.

yes, managed to bring up the 3rd wifi. Will soon submit a PR for it, but want to get the issue above solved first.

for 6GHz sae-mixed is not allowed

2 Likes

any other idea?

@robimarko or anyone else perhaps?

The BDF provided with the OEM firmware is for a newer firmware version than the one you're using. Do you have access to version 2.12?

There was a new version available (provided by @BrainSlayer) but without qcn6122 part: https://github.com/mirror/dd-wrt/commit/bbf19534b045250e580c746e11f00e6aa8ffe16f#diff-ed6b0ec14734ea0091b5d5245be73123e923a209f37c8d802e7d9229abeb3836

Have you tried using OEM firmware: WLAN.HK.2.8-01357-QCAHKSWPL_SILICONZ-1.45329.1.71292.1 v1: https://filebin.net/ko1mdwlkx2mrdm0g ?

And which firmware variant should you use:

  • IPQ5018
  • IPQ5018v2_spruce
  • IPQ5018v2_spr_spr

In OpenWrt only the last one is used: https://github.com/openwrt/openwrt/blob/main/package/firmware/ath11k-firmware/Makefile#L119

In OEM spr_spr version is used.

I know, I have tried different versions (2.7, 2.8 taken from stock, and 2.12 from QCA networking SPF).
I will soon submit a PR that will have ipq5018 boards use the right firmware:

  • IPQ5018 without QCN6122 (but with QCN9074 as an example): IPQ5018-only firmware so the official repo can be used to download the FW.
  • IPQ5018 with QCN6122 (one or two): IPQ5018/QCN6122 combined firmware from the legacy repo currently used (spr stands for spruce, their internal code name for QCN6122)

The patches are ready.

However, not sure if it's config, firmware or BDF related (or perhaps driver?).. How did you get QCN9074 to work?

Could it be differences between FCC and EU? My device is an EU model, though I’ve used the bdwlan from the FCC directory.
Will try EU bdwlan file with stock firmware 2.8 tomorrow, see if that makes a difference.

OEM BDF was quite old (firmware 2.4) and after update to firmware 2.9 format it just worked.

Have you tried using generic BDF: https://filebin.net/1uqvw001ckykcnd5?

There are 2 BDF files in the BDF directory for OEM firmware:

  • bdwlan.b60 (same as bdwlan.bin)
  • bdwlan.bb0

Do you know which BDF is being used?

The MX6200 has two QCN6122 chips in addition to the IPQ5018 internal wifi.
.b60 is for 5G
.bb0 is for 6G

Have tried a generic .bb0 from 2.12 QCA SPF, no joy.. but will do more tests tomorrow

Thanks for your support so far

to make the other qcn6122 wifi work, change the wifi node to:

	wifi2: wifi2@b00b040 {
		reg = <0x0b00b040 0x0>;
		compatible = "qcom,qcn6122-wifi";
		interrupts = <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 449 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 450 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 451 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 452 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 453 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 454 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 455 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 456 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 457 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 458 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 459 IRQ_TYPE_EDGE_RISING>,
			     <GIC_SPI 460 IRQ_TYPE_EDGE_RISING>;
		status = "disabled";
	};

can you send me your bdf files? (both bdwlan.bb0 and bdwlan.b60)

and can you post the output of: iw phy1 info and iw phy2 info

i can also provide the qca6122 part

I’ve got access to that version as part of the SPF, doesn’t solve my issue though..

6G is simply not visible on my device, testing with an iPhone 15 pro as a client. Will also test with a laptop with WiFi 6E soon

if 6g is not visible but the device is capable it can be just the board data. the format for the board data was changed in a way that all 6g settings are incompatible with newer firmwares (with new i think about 2.6 already). the problem is the regulatoey domain table (regdb.bin) which as a new format. but you can simply replace it if you know how to extract the segments from the datafiles. in addition getting 6g to work as also a little bit tricky to me. (mainly caused by hostapd foos. i had to patch and fix things in hostapd to get all correct to work with ath11k). consider that the beacons for 6g are broadcasted on the 5g and 2.4 band band (colocated). this cooperation made some headacke to me. and you have to make sure to use a PSD channel for some end devices. so in fact the iphone will never scan for 6 ghz. (like many other wifi cards, but realtek). they will look for the 6 ghz information in 2.4 and 5 ghz space

2 Likes

Interesting! Didn’t know that the beacons are broadcasted on 2.4 and 5G. Will enable all radios and try again. What did you have to patch in hostapd?

At this point I’m almost sure the issue is not in the bdf, I’ve tried upgrading it to the latest version, replaced the regen with the most current one, tried different regions, and a combination of.

But let me enable all radios and see what happens tomorrow

and it's working, massive thanks @BrainSlayer.

Will soon submit a PR for MX6200 triband support

beacon fixes for colocated properties. look into my hostapd-2025-01-04 folder. i think you will find the patches in its history. its now been a while i made these patches. i added new config parameter and beacon properties. it might be that such settings are now also upstream. but at that time i made it nothing was working

that's just formality but here you go https://filebin.net/euaj11uaqansekaf
I'll test your code tomorrow.