分析：
测试了很多遍，终于找到了解决方案，主要原因还是WiFi国家代码的问题。
12信道搜不到的时候，用命令# iw list查看结果，12、13和14信道都是disabled的。
用命令# iw reg set CN，也不起作用。
关于这个问题，这里有详细的并且有用的参考资料https://www.cnblogs.com/helloworldtoyou/p/9965019.html，其他地方的很多设置都没什么作用。
按分析，这个顺序802.11d > userspacecommands > gStaCountryCode in WCNSS_qcom_cfg.ini > DefaultCountryTable in WCNSS_qcom_wlan_nv.bin，修改g11dSupportEnabled=1后插上SIM卡应该是有用的，但不知道为什么，我修改了也不起作用，可能是没有修改gEnableBypass11d=1的缘故。但后续又测试了一遍，gEnableBypass11d=1和g11dSupportEnabled=1都设置了，还是不起作用。
最后解决：root手机后，要执行两个命令# mount -o remount,rw / 和 # setenforce 0，卷可读写，把selinux关掉，否则你修改不了文件内容。然后修改/system/vendor/firmware/waln/WCNSS_qcom_cfg.ini，添加一行内容：gStaCountryCode=CN，问题就解决了！
原版的配置可能会使WIFI连接速度很慢，以下是优化后的WCNSS_qcom_cfg.ini的全文，效果提升明显：
# This file allows user to override the factory
# defaults for the WLAN Driver
gStaCountryCode=CN
# Enable IMPS or not
gEnableImps=1
# Enable/Disable Idle Scan
gEnableIdleScan=0
# Increase sleep duration (seconds) during IMPS
# 0 implies no periodic wake up from IMPS. Periodic wakeup is
# unnecessary if Idle Scan is disabled.
gImpsModSleepTime=0
# Enable BMPS or not
gEnableBmps=1
# Enable suspend or not
# 1: Enable standby, 2: Enable Deep sleep, 3: Enable Mcast/Bcast Filter
gEnableSuspend=3
# Phy Mode (auto, b, g, n, etc)
# Valid values are 0-9, with 0 = Auto, 4 = 11n, 9 = 11ac
gDot11Mode=0
# CSR Roaming Enable(1) Disable(0)
gRoamingTime=0
#heart add for userspace set channel
gSapAllowAllChannel=1
# Assigned MAC Addresses - This will be used until NV items are in place
# Each byte of MAC address is represented in Hex format as XX
Intf0MacAddress=000AF58989FF
Intf1MacAddress=000AF58989FE
Intf2MacAddress=000AF58989FD
Intf3MacAddress=000AF58989FC
# UAPSD service interval for VO,VI, BE, BK traffic
InfraUapsdVoSrvIntv=0
InfraUapsdViSrvIntv=0
InfraUapsdBeSrvIntv=0
InfraUapsdBkSrvIntv=0
# Flag to allow STA send AddTspec even when ACM is Off
gAddTSWhenACMIsOff=1
# Make 1x1 the default antenna configuration
gNumRxAnt=1
# Beacon filtering frequency (unit in beacon intervals)
gNthBeaconFilter=50
# Enable WAPI or not
# WAPIIsEnabled=0
# Flags to filter Mcast abd Bcast RX packets.
# Value 0: No filtering, 1: Filter all Multicast.
# 2: Filter all Broadcast. 3: Filter all Mcast abd Bcast
McastBcastFilter=3
#Flag to enable HostARPOffload feature or not
hostArpOffload=1
#SoftAP Related Parameters
# AP MAc addr
gAPMacAddr=000AF589dcab
# 802.11n Protection flag
gEnableApProt=1
#Enable OBSS protection
gEnableApOBSSProt=1
#Enable/Disable UAPSD for SoftAP
gEnableApUapsd=1
# Fixed Rate
gFixedRate=0
# Maximum Tx power
# gTxPowerCap=30
# Fragmentation Threshold
# gFragmentationThreshold=2346
# RTS threshold
RTSThreshold=2347
# Intra-BSS forward
gDisableIntraBssFwd=0
# WMM Enable/Disable
WmmIsEnabled=0
# 802.11d support
g11dSupportEnabled=0
# CCX Support and fast transition
CcxEnabled=0
FastTransitionEnabled=1
ImplicitQosIsEnabled=0
gNeighborScanTimerPeriod=200
# default value of this parameter is zero to enable dynamic threshold allocation
# to set static roming threshold uncomment below parameter and set vaule
#gNeighborLookupThreshold=78
gNeighborScanChannelMinTime=20
gNeighborScanChannelMaxTime=30
# Legacy (non-CCX, non-802.11r) Fast Roaming Support
# To enable, set FastRoamEnabled=1
# To disable, set FastRoamEnabled=0
FastRoamEnabled=1
#Check if the AP to which we are roaming is better than current AP in terms of RSSI.
#Checking is disabled if set to Zero.Otherwise it will use this value as to how better
#the RSSI of the new/roamable AP should be for roaming
RoamRssiDiff=5
# SAP Country code
# Default Country Code is 2 bytes, 3rd byte is optional indoor or out door.
# Example
# US Indoor, USI
# Korea Outdoor, KRO
# Japan without optional byte, JP
# France without optional byte, FR
#gAPCntryCode=USI
#Short Guard Interval Enable/disable
gShortGI20Mhz=1
gShortGI40Mhz=1
#Auto Shutdown Value in seconds. A value of 0 means Auto shutoff is disabled
gAPAutoShutOff=0
# SAP auto channel selection configuration
# 0 = disable auto channel selection
# 1 = enable auto channel selection, channel provided by supplicant will be ignored
gApAutoChannelSelection=0
# Listen Energy Detect Mode Configuration
# Valid values 0-128
# 128 means disable Energy Detect feature
# 0-9 are threshold code and 7 is recommended value from system if feature is to be enabled.
# 10-128 are reserved.
# The EDET threshold mapping is as follows in 3dB step:
# 0 = -60 dBm
# 1 = -63 dBm
# 2 = -66 dBm
# ...
# 7 = -81 dBm
# 8 = -84 dBm
# 9 = -87 dBm
# Note: Any of these settings are valid. Setting 0 would yield the highest power saving (in a noisy environment) at the cost of more range. The range impact is approximately #calculated as:
#
# Range Loss (dB) = EDET threshold level (dBm) + 97 dBm.
#
gEnablePhyAgcListenMode=128
#Preferred channel to start BT AMP AP mode (0 means, any channel)
BtAmpPreferredChannel=0
#Preferred band (both or 2.4 only or 5 only)
BandCapability=0
#Beacon Early Termination (1 = enable the BET feature, 0 = disable)
enableBeaconEarlyTermination=1
beaconEarlyTerminationWakeInterval=11
#Bluetooth Alternate Mac Phy (1 = enable the BT AMP feature, 0 = disable)
gEnableBtAmp=0
#SOFTAP Channel Range selection
gAPChannelSelectStartChannel=1
gAPChannelSelectEndChannel=11
#SOFTAP Channel Range selection Operating band
# 0:2.4GHZ 1: LOW-5GHZ 2:MID-5GHZ 3:HIGH-5GHZ 4: 4.9HZ BAND
gAPChannelSelectOperatingBand=0
#Channel Bonding
gChannelBondingMode2.4GHz=1
gChannelBondingMode5GHz=1
gEnableModulatedDTIM = 3
gMaxLIModulatedDTIM = 3
gEnableDatainactivity = 200
#Enable Keep alive with non-zero period value
gStaKeepAlivePeriod=30
#Say gGoKeepAlivePeriod(5 seconds) and gGoLinkMonitorPeriod(10 seconds).
#For every 10 seconds DUT sends Qos Null frame(i.e., Keep Alive frame if link is idle for last 10 seconds.)
#For both active and power save clients.
#Power save clients: DUT set TIM bit from 10th second onwards and till client honors TIM bit.
#If doesn't honor for 5 seconds then Driver remove client.
#Active clients: DUT send Qos Null frame for 10th seconds onwards if it is not success still DUT try on
#11th second if not tries on 12th and so on till 15th second. Hence before disconnection DUT will send 5 NULL frames.
#Hence in any case DUT will detect client got removed in (10+5) seconds. i.e., (gGoKeepAlivePeriod +gGoLinkMonitorPeriod)..
#gGoLinkMonitorPeriod/ gApLinkMonitorPeriod is period where link is idle and it is period
#where we send NULL frame.
#gApLinkMonitorPeriod = 10
#gGoLinkMonitorPeriod = 10
#gGoKeepAlivePeriod/gApKeepAlivePeriod is time to spend to check whether frame are succeed to send or not.
#Hence total effective detection time is gGoLinkMonitorPeriod+ gGoKeepAlivePeriod/gApLinkMonitorPeriod+ gApKeepAlivePeriod.
gGoKeepAlivePeriod = 10
gApKeepAlivePeriod = 30
#If set will start with active scan after driver load, otherwise will start with
#passive scan to find out the domain
#gEnableBypass11d=1
#If set to 0, will not scan DFS channels
gEnableDFSChnlScan=1
gEnableLogp=1
# Enable Automatic Tx Power control
gEnableAutomaticTxPowerControl=1
# 0 for OLPC 1 for CLPC and SCPC
gEnableCloseLoop=1
#Data Inactivity Timeout when in powersave (in ms)
gDataInactivityTimeout=200
gEnableLpwrImgTransition=1
# Scan Timing Parameters
# gPassiveMaxChannelTime=110
# gPassiveMinChannelTime=60
# Enable Tx LDPC
#gTxLdpcEnable = 1 for HT mode, 2 for VHT mode,3 for both HT and VHT
gTxLdpcEnable=3
# gActiveMaxChannelTime=40
# gActiveMinChannelTime=20
# Valid values are 2048,4096,8192 and so on
# Please don't use values other than the ones mentioned above
gMaxMediumTime=4096
# 802.11K support
gRrmEnable=1
gRrmOperChanMax=8
gRrmNonOperChanMax=8
gRrmRandIntvl=100
#Scan offload
gEnableDirectedScanOffload=0
#FlexConnect Power Factor
#Default is set to 0 (disable)
gFlexConnectPowerFactor=0
gVhtChannelWidth=2
# VHT Tx/Rx MCS values
# Valid values are 0,1,2. If commented out, the default value is 0.
# 0=MCS0-7, 1=MCS0-8, 2=MCS0-9
gVhtRxMCS=2
gVhtTxMCS=2
# Enable Tx beamforming
gTxBFEnable=1
END
# Note: Configuration parser would not read anything past the END marker