[Galaxy S 5 Q&A, Help & Troubleshooting] stukjetaart:
Dear all,

I know this is not the correct thread but I don't have enough privileges to post in development.

EDIT: crap, just saw there is a Q&A section, messed up the location of my first post it seems.

The Project

Roaming is bad on most android devices for VOIP. This is due to the fact that you can't change the default parameters efficiently.

I wrote a fix for the broadcom drivers (BCMDHD4354 and BCMDHD) by means of using the iotcl's and a custom tool I wrote to change the default parameters (delta, trigger, interval)

The problem

When I compiled the stock kernel G900FXXU1ANG2 found on the opensource page of samsung I had no error's whatsoever.

The device booted fine and everything seemed to work. I was able to adjust the roaming parameters successfully.

However ...

After turning the wifi on and off by means of reboot or just turning it off or whatever, the connection profile is lost.

The entry found before in wpa supplicant is gone and is replaced by this:

cat /data/misc/wifi/wpa_supplicant.conf
ctrl_interface=/data/misc/wifi/sockets
update_config=1
device_name=kltexx
manufacturer=samsung
model_name=SM-G900F
model_number=SM-G900F
serial_number=8e98743f
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_disabled=1
okc=1
ss_enc=1
autoscan=samsung_exponential:8:128

cred={
imsi="?"
}

It also takes a very long time to actually turn on the wifi. The stockrom takes around one second while my kernel version takes 8-10 seconds.

The steps I allready took

kernel without any customization

I downloaded the source again (just to be sure) and compiled it without any changes. Using the build_msm8974pro_kernel.sh script found with the kernel (with some small adaptions regarding folder locations and toolchains).

It compiled fine and was able to successfully flash the zImage on the phone: Still the same issue, so its not because of my small change to the BCMDHD4354 driver.

in short the script can be reduced to this:

make -C ../kernel O=../okernel -j4 ARCH=arm \
CROSS_COMPILE=/opt/toolchains/gcc-arm-none-eabi-4_7-2014q2/bin/arm-none-eabi- \
msm8974_sec_defconfig VARIANT_DEFCONFIG=msm8974pro_sec_klte_eur_defconfig \
DEBUG_DEFCONFIG=msm8974_sec_eng_defconfig SELINUX_DEFCONFIG=selinux_defconfig \
SELINUX_LOG_DEFCONFIG=selinux_log_defconfig || exit -1

Toolchains

Samsung suggests to build the kernel using the arm-eabi-4.6 toolchain. However, the sockrom uses the gcc 4.7 library, so I tried both. (got some errors with the 4.6 not finding certain headers etc... which I fixed by mannually adding them).

However, I got the same problem using both toolchains. So I don't think it's a toolchain problem.

DMESG log

I disabled the wifi and started a clean dmesg log the moment I turned wifi back on to compare the differences with the stock and the compiled stock.

(I got a lot more debugging messages, but that is probly because it is configured that way in my defconfig file).

Besides taking 10 seconds longer before showing up in the dmesg there does not seem to be anything off.

Custom:

root@klte:/ # dmesg
dmesg
<6>[ 93.693003] secure_storage_ (5477): undefined instruction: pc=b6dd7548
<6>[ 93.693018] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 93.704726] QSEECOM: qseecom_load_app: App (sec_stor) does'nt exist, loading apps for first time
<4>[ 93.717920] QSEECOM: qseecom_load_app: App with id 2 (sec_stor) now loaded
<4>[ 93.760176] QSEECOM: qseecom_unload_app: App id 2 now unloaded
<6>[ 96.410056] CFG80211-INFO2) wl_scan_timeout : timer expired but no scan request
<6>[ 96.561489] max77804k_get_input_current: CHG_CNFG_09(0x12)
<6>[ 96.563822] max77804k_get_input_current: CHG_CNFG_09(0x12)
<7>[ 96.593202] sec-fuelgauge 19-0036: sec_fg_get_scaled_capacity: scaled capacity (101.0)
<6>[ 96.593260] sec-battery battery.97: sec_bat_get_battery_info:Vnow(4387mV),Inow(450mA),Imax(460mA),SOC(100%),Tbat(294)
<6>[ 96.618093] max77804k_get_health_state: bat_dtls(0x3) int_mask(0x9a)
<6>[ 96.621311] max77804k_get_health_state: vbus_state : 0x3, chg_dtls : 0x3
<6>[ 96.621362] sec-battery battery.97: sec_bat_time_management: Charging Time : 91 secs
<6>[ 96.621416] sec-battery battery.97: sec_bat_temperature: HLT(800) HLR(750) HT(600), HR(460), LT(-50), LR(0)
<6>[ 96.621472] sec-battery battery.97: sec_bat_fullcharged_check: Charging Mode : Additional
<6>[ 96.621522] sec-battery battery.97: sec_bat_monitor_work: Status(Full), Mode(Additional), Health(Good), Cable(4), Vendor(SDI SDI), siop_level(70)
<6>[ 96.621575] sec-battery battery.97: sec_bat_monitor_work: stability_test(0), eng_not_full_status(0) slate_mode(0)
<6>[ 96.630069] healthd: battery l=100 v=4387 t=29.4 h=2 st=5 c=0 o=4 ca=450 ct=1 ps=0 chg=u
<6>[ 97.360330] Debug Temp for Sensor:
<6>[ 97.360435] (0 --- 43)(1 --- 42)(2 --- 41)(3 --- 42)(4 --- 42)(5 --- 43)(6 --- 42)(7 --- 42)(8 --- 42)(9 --- 42)(10 --- 41)
<6>[ 98.267735] synaptics_rmi4_i2c 2-0020: [0][P] 0x01, x = 757, y = 168, wx = 5, wy = 5 |[1]
<6>[ 98.320636] synaptics_rmi4_i2c 2-0020: [0][R] 0x00 M[4], Ver[A355][0/14]
<6>[ 98.368072] secure_storage_ (5485): undefined instruction: pc=b6dab548
<6>[ 98.368087] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 98.377907] QSEECOM: qseecom_load_app: App (sec_stor) does'nt exist, loading apps for first time
<6>[ 98.387574] wpa_supplicant (5487): undefined instruction: pc=b6e1b548
<6>[ 98.387584] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 98.399498] QSEECOM: qseecom_load_app: App with id 2 (sec_stor) now loaded
<4>[ 98.426938] QSEECOM: qseecom_unload_app: App id 2 now unloaded
<6>[ 101.090347] [SSP]: debug_work_func(0) - Sensor state: 0x3feff, RC: 0, CC: 0 DC: 0 TC: 0
<6>[ 101.090393] vfsspi_work_func_debug ocp state: 0, ocp en: 0 ldo pin: 0, sleep pin: 0, tz_mode: 1
<6>[ 101.091348] dmesg (5507): undefined instruction: pc=b6e43548
<6>[ 101.091361] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<3>[ 101.652891] reading MSM_THERM_CH [rc = 0] [adc_code = 31567]
<6>[ 102.370160] Debug Temp for Sensor:
<6>[ 102.370264] (0 --- 41)(1 --- 40)(2 --- 40)(3 --- 41)(4 --- 41)(5 --- 41)(6 --- 41)(7 --- 40)(8 --- 41)(9 --- 41)(10 --- 40)
<6>[ 102.499529] dmesg (5510): undefined instruction: pc=b6dd1548
<6>[ 102.499568] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 103.578665] !@Sync 3
<6>[ 103.729261] secure_storage_ (5513): undefined instruction: pc=b6db3548
<6>[ 103.729279] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 103.740552] QSEECOM: qseecom_load_app: App (sec_stor) does'nt exist, loading apps for first time
<4>[ 103.756539] QSEECOM: qseecom_load_app: App with id 2 (sec_stor) now loaded
<4>[ 103.801920] QSEECOM: qseecom_unload_app: App id 2 now unloaded
<6>[ 105.180716] dmesg (5514): undefined instruction: pc=b6e65548
<6>[ 105.180755] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 106.119765] dmesg (5516): undefined instruction: pc=b6e82548
<6>[ 106.119819] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 106.665073] max77804k_get_input_current: CHG_CNFG_09(0x12)
<6>[ 106.666137] max77804k_get_input_current: CHG_CNFG_09(0x12)
<7>[ 106.694353] sec-fuelgauge 19-0036: sec_fg_get_scaled_capacity: scaled capacity (101.0)
<6>[ 106.694397] sec-battery battery.97: sec_bat_get_battery_info:Vnow(4387mV),Inow(450mA),Imax(460mA),SOC(100%),Tbat(294)
<6>[ 106.718716] max77804k_get_health_state: bat_dtls(0x3) int_mask(0x9a)
<6>[ 106.721475] max77804k_get_health_state: vbus_state : 0x3, chg_dtls : 0x3
<6>[ 106.721518] sec-battery battery.97: sec_bat_monitor_work: Status(Full), Mode(Additional), Health(Good), Cable(4), Vendor(SDI SDI), siop_level(70)
<6>[ 106.721559] sec-battery battery.97: sec_bat_monitor_work: stability_test(0), eng_not_full_status(0) slate_mode(0)
<6>[ 106.729328] healthd: battery l=100 v=4387 t=29.4 h=2 st=5 c=0 o=4 ca=450 ct=1 ps=0 chg=u
<6>[ 106.970738] dmesg (5518): undefined instruction: pc=b6dff548
<6>[ 106.970754] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 107.380213] Debug Temp for Sensor:
<6>[ 107.380316] (0 --- 41)(1 --- 40)(2 --- 39)(3 --- 40)(4 --- 40)(5 --- 40)(6 --- 40)(7 --- 40)(8 --- 40)(9 --- 40)(10 --- 39)
<6>[ 108.165214] dmesg (5520): undefined instruction: pc=b6eb2548
<6>[ 108.165231] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 108.456315]
<4>[ 108.456327] Dongle Host Driver, version 1.141.64 (r)
<4>[ 108.456343] Compiled in drivers/net/wireless/bcmdhd4354 on Mar 23 2015 at 09:41:26
<4>[ 108.456386] wl_android_wifi_on in
<4>[ 108.456424] wifi_platform_set_power = 1
<6>[ 108.456452] ------------------------------------------------
<6>[ 108.456481] ------------------------------------------------
<6>[ 108.456514] brcm_wlan_power Enter: power on
<6>[ 108.457764] WL_REG_ON on-step : [0]
<6>[ 108.457800] pcal6416a_gpio_direction_output(off=[8], val=[1])
<6>[ 108.462554] WL_REG_ON on-step-2 : [1]
<4>[ 108.700163] sdio_reset_comm():
<4>[ 108.751959] mmc1: queuing unknown CIS tuple 0x80 (2 bytes)
<4>[ 108.756041] mmc1: queuing unknown CIS tuple 0x80 (7 bytes)
<4>[ 108.758269] mmc1: queuing unknown CIS tuple 0x80 (3 bytes)
<6>[ 108.848597] secure_storage_ (5523): undefined instruction: pc=b6da1548
<6>[ 108.848614] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 108.861303] F1 signature OK, socitype:0x1 chip:0x4354 rev:0x1 pkg:0x0
<4>[ 108.862623] QSEECOM: qseecom_load_app: App (sec_stor) does'nt exist, loading apps for first time
<4>[ 108.863191] DHD: dongle ram size is set to 786432(orig 786432) at 0x180000
<4>[ 108.863717] dhdsdio_download_firmware: firmware path=/system/etc/wifi/bcmdhd_sta.bin, nvram path=/system/etc/wifi/nvram_net.txt_semco3rd
<4>[ 108.876014] QSEECOM: qseecom_load_app: App with id 2 (sec_stor) now loaded
<4>[ 108.915372] QSEECOM: qseecom_unload_app: App id 2 now unloaded
<4>[ 108.963772] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
<4>[ 109.011066] dhd_bus_init: enable 0x06, ready 0x06 (waited 0us)
<4>[ 109.013853] dhd_wl_ioctl: WLC_GET_VAR: cisdump, ret = -23
<4>[ 109.013862] [WIFI_SEC] dhd_check_module_cid: CIS reading failed, ret=-23
<4>[ 109.016449] Firmware up: op_mode=0x0005, MAC=84:33:32
<4>[ 109.022932] dhdcdc_set_ioctl: SET PM to 2
<4>[ 109.023288] [WIFI_SEC] sec_control_pm: /data/.psm.info open failed, so set PM to 2
<4>[ 109.024880] [WIFI_SEC] dhd_sel_ant_from_file: File [/data/.ant.info] open error
<4>[ 109.027944] dhd_wl_ioctl: WLC_SET_VAR: pspretend_threshold, ret = -23
<4>[ 109.027953] dhd_preinit_ioctls pspretend_threshold for HostAPD failed -23
<4>[ 109.034028] Firmware version = wl0: Jun 11 2014 21:58:43 version 7.26.5.2 (A1 Station/P2P) FWID 01-8e4c322
<4>[ 109.034838] [WIFI_SEC] sec_save_wlinfo: .wifiver.info File open failed.
<4>[ 109.035965] dhd_wlfc_hostreorder_init(): successful bdcv2 tlv signaling, 64
<4>[ 109.036391] dhd_wl_ioctl: WLC_GET_VAR: pfnlbest, ret = -14
<4>[ 109.037788] dhd_wl_ioctl: WLC_GET_VAR: cisdump, ret = -23
<4>[ 109.037800] [WIFI_SEC] dhd_check_module_mac: Check module mac by legacy FW : 84:33:32
<4>[ 109.037921] [WIFI_SEC] Check Mac address in .mac.info
<6>[ 109.039168] CFG80211-INFO2) wl_cfg80211_attach_post : p2p0: p2p_dev_addr=86:33:32
<6>[ 109.141663] dmesg (5526): undefined instruction: pc=b6dfc548
<6>[ 109.141678] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 110.891535] dmesg (5528): undefined instruction: pc=b6e63548
<6>[ 110.891574] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<3>[ 111.708851] reading MSM_THERM_CH [rc = 0] [adc_code = 31807]
<6>[ 111.753992] dmesg (5530): undefined instruction: pc=b6e2a548
<6>[ 111.754031] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 112.090633] [SSP]: debug_work_func(0) - Sensor state: 0x3feff, RC: 0, CC: 0 DC: 0 TC: 0
<6>[ 112.090718] vfsspi_work_func_debug ocp state: 0, ocp en: 0 ldo pin: 0, sleep pin: 0, tz_mode: 1
<6>[ 112.390254] Debug Temp for Sensor:
<6>[ 112.390355] (0 --- 40)(1 --- 39)(2 --- 38)(3 --- 40)(4 --- 40)(5 --- 40)(6 --- 40)(7 --- 39)(8 --- 39)(9 --- 40)(10 --- 39)
<6>[ 112.548404] dmesg (5532): undefined instruction: pc=b6deb548
<6>[ 112.548443] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 113.787197] secure_storage_ (5535): undefined instruction: pc=b6e44548
<6>[ 113.787214] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<4>[ 113.797691] QSEECOM: qseecom_load_app: App (sec_stor) does'nt exist, loading apps for first time
<4>[ 113.813220] QSEECOM: qseecom_load_app: App with id 2 (sec_stor) now loaded
<4>[ 113.886957] QSEECOM: qseecom_unload_app: App id 2 now unloaded
<4>[ 114.236388] dhd_wl_ioctl: WLC_SET_VAR: mws_coex_bitmap, ret = -23
<4>[ 114.236412] LTECX_CHAN_BITMAP error -23
<6>[ 114.260260] [SSP] batch 0: delay 66000000, timeout 0, flag 1, ret 0
<6>[ 114.260358] [SSP] batch 0: delay 66000000, timeout 0, flag 0, ret 0
<6>[ 114.260634] [SSP]: set_sensors_enable - new_enable = 1, old_enable = 0
<6>[ 114.260659] [SSP]: send_instruction - Inst = 0xa1, Sensor Type = 0x0, data = 66
<6>[ 114.277962] [SSP], delay 66, timeout 0, flag=0, ret1
<6>[ 114.289037] [SSP]: MSG From MCU - RM 0 1 0 0
<6>[ 114.289046] AR-0,155,-78,-16881
<6>[ 114.289052] AR-0,198,-2,-16845
<6>[ 114.289057] AD 0 2 0 1
<6>[ 114.361413] CFG80211-TRACE) __wl_cfg80211_scan : START SCAN
<6>[ 114.595632] dmesg (5552): undefined instruction: pc=b6e50548
<6>[ 114.595644] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 114.957791] CFG80211-TRACE) wl_escan_handler : SCAN COMPLETED: scanned AP count=11
<6>[ 115.041899] CFG80211-TRACE) __wl_cfg80211_scan : START SCAN
<6>[ 116.741258] max77804k_get_input_current: CHG_CNFG_09(0x12)
<6>[ 116.742308] max77804k_get_input_current: CHG_CNFG_09(0x12)
<7>[ 116.771405] sec-fuelgauge 19-0036: sec_fg_get_scaled_capacity: scaled capacity (101.0)
<6>[ 116.771422] sec-battery battery.97: sec_bat_get_battery_info:Vnow(4388mV),Inow(450mA),Imax(460mA),SOC(100%),Tbat(294)
<6>[ 116.794821] max77804k_get_health_state: bat_dtls(0x3) int_mask(0x9a)
<6>[ 116.796692] max77804k_get_health_state: vbus_state : 0x3, chg_dtls : 0x3
<6>[ 116.796709] sec-battery battery.97: sec_bat_monitor_work: Status(Full), Mode(Additional), Health(Good), Cable(4), Vendor(SDI SDI), siop_level(70)
<6>[ 116.796724] sec-battery battery.97: sec_bat_monitor_work: stability_test(0), eng_not_full_status(0) slate_mode(0)
<6>[ 116.799714] healthd: battery l=100 v=4388 t=29.4 h=2 st=5 c=0 o=4 ca=450 ct=1 ps=0 chg=u
<6>[ 117.342213] dmesg (5561): undefined instruction: pc=b6e03548
<6>[ 117.342227] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)

Stock:

root@klte:/ # dmesg
dmesg
<6>[ 101.327392] synaptics_rmi4_i2c 2-0020: [0][P] 0x01
<6>[ 101.379872] synaptics_rmi4_i2c 2-0020: [0][R] 0x00 M[4], Ver[A355][0/14]
<6>[ 101.425208] SLIMBUS_0_RX: dpcm: open BE SLIMBUS_0_RX
<6>[ 101.425222] MSM8974 LowLatency: dpcm: open FE MSM8974 LowLatency
<6>[ 101.425287] msm_slim_0_rx_be_hw_params_fixup: format = 2, rate = 48000, channels = 1
<6>[ 101.425296] taiko_esxxx_get_channel_map(): dai_name = taiko_rx1 DAI-ID 0 tx_ch 0 rx_ch 0
<7>[ 101.425306] es705-codec es705-codec-gen0: es705_remote_route_enable():dai->name = taiko_rx1 dai->id = 0
<6>[ 101.425316] taiko_esxxx_hw_params: dai_name = taiko_rx1 DAI-ID 0 rate 48000 num_ch 1
<6>[ 101.425322] taiko_hw_params: dai_name = taiko_rx1 DAI-ID 0 rate 48000 num_ch 1
<7>[ 101.425338] es705-codec es705-codec-gen0: es705_remote_route_enable():dai->name = taiko_rx1 dai->id = 0
<6>[ 101.425350] __q6asm_open_write: session[1] wr_format[0x0]
<6>[ 101.425356] __q6asm_open_write: session[1] open.mode_flags:10000000
<6>[ 101.428819] q6asm_audio_client_buf_alloc_contiguous: session[1]bufsz[960]bufcnt[2]
<6>[ 101.452287] wpa_supplicant (5602): undefined instruction: pc=b6d3b548
<6>[ 101.452299] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)
<6>[ 101.456934] es705-codec es705-codec-gen0: es705_remote_cfg_slim_rx(): dai_id = 0
<6>[ 101.456943] Before slim_define_ch:
<6>[ 101.456946] ch_cnt 1,ch_h[0] 16 ch_h[1] 0, grph 272 sampleszbits 16
<3>[ 101.477343] reading MSM_THERM_CH [rc = 0] [adc_code = 31012]
<6>[ 101.717989] Governor: enter mode 0x1
<4>[ 101.719712]
<4>[ 101.719715] Dongle Host Driver, version 1.141.64 (r)
<4>[ 101.719720] Compiled in drivers/net/wireless/bcmdhd4354 on Jul 3 2014 at 14:10:22
<4>[ 101.719730] wl_android_wifi_on in
<4>[ 101.719739] wifi_platform_set_power = 1
<6>[ 101.719746] ------------------------------------------------
<6>[ 101.719754] ------------------------------------------------
<6>[ 101.719762] brcm_wlan_power Enter: power on
<6>[ 101.720346] WL_REG_ON on-step : [0]
<6>[ 101.720356] pcal6416a_gpio_direction_output(off=[8], val=[1])
<6>[ 101.722417] WL_REG_ON on-step-2 : [1]
<6>[ 101.817994] Governor: exit mode 0x0
<4>[ 101.958194] sdio_reset_comm():
<4>[ 102.013000] mmc1: queuing unknown CIS tuple 0x80 (2 bytes)
<4>[ 102.016479] mmc1: queuing unknown CIS tuple 0x80 (7 bytes)
<4>[ 102.018887] mmc1: queuing unknown CIS tuple 0x80 (3 bytes)
<4>[ 102.139432] F1 signature OK, socitype:0x1 chip:0x4354 rev:0x1 pkg:0x0
<4>[ 102.140493] DHD: dongle ram size is set to 786432(orig 786432) at 0x180000
<4>[ 102.140893] dhdsdio_download_firmware: firmware path=/system/etc/wifi/bcmdhd_sta.bin, nvram path=/system/etc/wifi/nvram_net.txt_semco3rd
<4>[ 102.226624] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
<4>[ 102.274236] dhd_bus_init: enable 0x06, ready 0x06 (waited 0us)
<4>[ 102.276911] dhd_wl_ioctl: WLC_GET_VAR: cisdump, ret = -23
<4>[ 102.276920] [WIFI_SEC] dhd_check_module_cid: CIS reading failed, ret=-23
<4>[ 102.280067] Firmware up: op_mode=0x0005, MAC=84:33:32
<4>[ 102.285947] dhdcdc_set_ioctl: SET PM to 2
<4>[ 102.286257] [WIFI_SEC] sec_control_pm: /data/.psm.info open failed, so set PM to 2
<4>[ 102.287833] [WIFI_SEC] dhd_sel_ant_from_file: File [/data/.ant.info] open error
<4>[ 102.290706] dhd_wl_ioctl: WLC_SET_VAR: pspretend_threshold, ret = -23
<4>[ 102.290713] dhd_preinit_ioctls pspretend_threshold for HostAPD failed -23
<4>[ 102.296346] Firmware version = wl0: Jun 11 2014 21:58:43 version 7.26.5.2 (A1 Station/P2P) FWID 01-8e4c322
<4>[ 102.296550] [WIFI_SEC] sec_save_wlinfo: .wifiver.info File open failed.
<4>[ 102.297750] dhd_wlfc_hostreorder_init(): successful bdcv2 tlv signaling, 64
<4>[ 102.298165] dhd_wl_ioctl: WLC_GET_VAR: pfnlbest, ret = -14
<4>[ 102.299421] dhd_wl_ioctl: WLC_GET_VAR: cisdump, ret = -23
<4>[ 102.299430] [WIFI_SEC] dhd_check_module_mac: Check module mac by legacy FW : 84:33:32
<4>[ 102.299590] [WIFI_SEC] Check Mac address in .mac.info
<6>[ 102.300345] CFG80211-INFO2) wl_cfg80211_attach_post : p2p0: p2p_dev_addr=86:33:32
<6>[ 102.468055] Debug Temp for Sensor:
<6>[ 102.468089] (0 --- 49)(1 --- 45)(2 --- 44)(3 --- 45)(4 --- 47)(5 --- 53)(6 --- 48)(7 --- 47)(8 --- 49)(9 --- 45)(10 --- 44)dhd_wl_ioctl: WLC_SET_VAR: mws_coex_bitmap, ret = -23
<4>[ 102.566476] LTECX_CHAN_BITMAP error -23
<6>[ 102.611939] CFG80211-TRACE) __wl_cfg80211_scan : START SCAN
<6>[ 102.653459] !@Sync 3
<6>[ 103.178451] CFG80211-TRACE) wl_escan_handler : SCAN COMPLETED: scanned AP count=7
<6>[ 103.308893] CFG80211-TRACE) __wl_cfg80211_scan : START SCAN
<6>[ 103.335840] [SSP] batch 0: delay 66000000, timeout 0, flag 1, ret 0
<6>[ 103.335880] [SSP] batch 0: delay 66000000, timeout 0, flag 0, ret 0
<6>[ 103.336102] [SSP]: set_sensors_enable - new_enable = 1, old_enable = 0
<6>[ 103.336121] [SSP]: send_instruction - Inst = 0xa1, Sensor Type = 0x0, data = 66
<6>[ 103.344646] [SSP], delay 66, timeout 0, flag=0, ret1
<6>[ 103.355432] [SSP]: MSG From MCU - RM 0 1 0 0
<6>[ 103.355438] AR-0,201,-31,-16894
<6>[ 103.355440] AD 0 2 0 1
<6>[ 103.637994] Governor: enter mode 0x1
<6>[ 105.097993] Governor: exit mode 0x0
<6>[ 105.398623] MSM8974 LowLatency: dpcm: close FE MSM8974 LowLatency
<6>[ 105.439585] SLIMBUS_0_RX: dpcm: close BE MSM8974 LowLatency
<6>[ 105.456839] es705-codec es705-codec-gen0: es705_remote_close_slim_rx(): dai_id = 0
<6>[ 105.577413] dmesg (5668): undefined instruction: pc=b6e48548
<6>[ 105.577455] Code: ea000002 00000000 f26ee1fe e12fff1e (ee190f1d)

Any ideas what I could be missing?