[Help] Custom Orio rom - wifi sleep terror every 5 minutes - Android Q&A, Help & Troubleshooting

Hi,
So I'm terrorized by audio stream cutout after 5 minutes while screen is off.
This happens while streaming thru browser also with MX Player Pro streams cuts off,
and does not return until screen is powered on..
I tried ServeStream and while it works, it to suffers from 10-15sec of audio cutout every 5min blaming buffer is empty..
So I tried setting:
Wifi network : Not metered
Unrestricted data usage: Browser (NBP), Media (MTP Host), ServeStream
Battery Not optimized : Browser (NBP), Media Storage, MTP Host, MX Player Pro, ServeStream
(just for oldschool times; adb shell settings put global wifi_sleep_policy 2)
But nothing gives, what else is there to do?
I'm trying practise playing along with a buddy of mine and this utter madness is ruining it.
Captured from logcat what occurse every time streaming thru browser.
HTML:
.
.
W chromium: [WARNING:audio_sync_reader.cc(193)] AudioSyncReader::Read timed out, audio glitch count=30
.
.
D : PlayerBase::stop() from IPlayer
D AudioTrack: stop() called with 19371008 frames delivered
E AudioAttributes: Illegal value unmarshalling AudioAttributes, can't initialize bundle
E AudioService.PlaybackActivityMonitor: Error updating audio attributes
D : PlayerBase::stop() from IPlayer
W AudioFlinger: moveEffectChain_l() effect chain for session 0 not on source thread 0xadc039c0
W BroadcastQueue: Background execution not allowed: receiving Intent { act=lineageos.intent.action.ACTION_AUDIO_SESSIONS_CHANGED flg=0x10000010 (has extras) } to org.lineageos.audiofx/.receiver.ServiceDispatcher
D audio_hw_primary: out_standby: enter: stream (0xaeebd800) usecase(0: deep-buffer-playback)
D hardware_info: hw_info_append_hw_type : device_name = speaker
D : TrackPlayerBase::~TrackPlayerBase()
: PlayerBase::~PlayerBase()
.
.
I WifiService: requestActivityInfo uid=1000
I WifiService: reportActivityInfo uid=1000
I WifiService: getSupportedFeatures uid=1000
D WifiHAL : In DebugCommand::handleResponse
D WifiHAL : len = 4, expected len = 4
D lights.msm8974: led [solid] = ff0d0200
D WifiHAL : In DebugCommand::handleResponse
D WifiHAL : len = 4, expected len = 4
E BatteryExternalStatsWorker: no controller energy info supplied for wifi
E BatteryExternalStatsWorker: no controller energy info supplied for bluetooth
D lights.msm8974: led [solid] = ff0d0200
E BatteryExternalStatsWorker: modem info is invalid: ModemActivityInfo{ mTimestamp=0 mSleepTimeMs=0 mIdleTimeMs=0 mTxTimeMs[]=[0, 0, 0, 0, 0] mRxTimeMs=0 mEnergyUsed=0}
.
.
Current rom AICP 13.1

Related

Bluetooth not turning on

Hello,
Trying to port CM13.0 to MMX A316
Bluetooth not turning on. Copied bluetooth.apk (with odex), etc/bluetooth and the standard lib files
Logcat:
Code:
12-31 13:44:14.080 2332 3029 D BluetoothAdapterState: CURRENT_STATE=PENDING, M
ESSAGE = START_TIMEOUT, isTurningOn=true, isTurningOff=false
12-31 13:44:14.081 2332 3029 E BluetoothAdapterState: Error enabling Bluetooth
12-31 13:44:14.081 2332 3029 D BluetoothAdapterProperties: Setting state to 10
12-31 13:44:14.081 2332 3029 I BluetoothAdapterState: Bluetooth adapter state
changed: 11-> 10
12-31 13:44:14.081 2332 3029 D BluetoothAdapterService: Broadcasting updateAda
pterState() to 1 receivers.
12-31 13:44:14.082 1007 1067 D BluetoothManagerService: Message: 60
12-31 13:44:14.082 1007 1067 D BluetoothManagerService: MESSAGE_BLUETOOTH_STAT
E_CHANGE: prevState = 11, newState=10
12-31 13:44:14.082 1007 1067 D BluetoothManagerService: Bluetooth is complete
turn off
12-31 13:44:14.082 2332 3029 I BluetoothAdapterState: Entering OffState
12-31 13:44:14.111 1007 2008 D lights : write_int open fd=202
12-31 13:44:14.114 1881 1881 W ContextImpl: Calling a method in the system pro
cess without a qualified user: android.app.ContextImpl.startService:1231 android
.content.ContextWrapper.startService:587 android.content.ContextWrapper.startSer
vice:587 com.android.settings.bluetooth.DockEventReceiver.beginStartingService:1
34 com.android.settings.bluetooth.DockEventReceiver.onReceive:115
12-31 13:44:14.138 1881 1881 D DockEventReceiver: finishStartingService: stopp
ing service
12-31 13:44:14.184 1881 2654 D Index : Deleting data for locale 'en_US' took
14 millis
12-31 13:44:14.185 2332 2344 D BluetoothAdapterService(83408720): getState():
mAdapterProperties: [email protected]
12-31 13:44:14.187 1881 2654 D Index : Indexing locale 'en_US' took 3 millis
12-31 13:44:14.332 1007 1048 W BroadcastQueue: Skipping deliver [background] B
roadcastRecord{d494edc u-1 android.intent.action.BATTERY_CHANGED} to ReceiverLis
t{6e46cb9 2332 com.android.bluetooth/1002/u0 remote:4155e80}: process crashing

(Discontinued) Lineage OS For R1HD (Discontinued)

This is a beta rom for R1HD compile from Lineage OS.
Lineage OS replaced CyanogenMod
The rom works well, but camera doesn't work.
I can't honestly say it's better that @KazuDante CM14.1 port. try both use what everyone you like, or use stock.
The blobs from this rom come from V17 not 7.4.2 keep that in mind if you decide to swap some files.
I only compiled rom today, sim, wifi works normal stuff works.
Camera doesn't work
@KazuDante Port
https://forum.xda-developers.com/r1-hd/development/cm14-1-r1hd-t3518202
R1HD device tree
https://github.com/vampirefo/android_device_blu_p6601
You can also get to my device tree, via phone.
Settings > about phone > Build author Vampirefo.
Clicking my name will open browser to my R1HD device tree.
This rom uses stock kernel
I recommend using my twrp recovery, but use which ever recovery you want.
My TWRP Recovery
https://www.androidfilehost.com/?fid=745425885120696177
to install flash or boot into twrp recovery
download lineage-14.1-20170102-UNOFFICIAL-p6601.zip
https://www.androidfilehost.com/?fid=529152257862692509
place on lineage-14.1-20170102-UNOFFICIAL-p6601.zip micro sdcard
factory reset
install lineage-14.1-20170102-UNOFFICIAL-p6601.zip
reboot you can flash gapps when every you like, I do a full reboot before flash gapps.
Gapps
http://opengapps.org/
credits
@oleg.svs
@DeckerSU
@KazuDante
@lineage OS
@vampirefo
Nice work all. Let me know when Camera works. Hopefully it's some easy fix.
Edit: Vamp, Don't know if it will help or not but here is the code review for another phone I have where they just fixed the camera for Lineage.
https://review.lineageos.org/#/q/st...evice_huawei_kiwi+branch:cm-14.1+topic:camera
@vampire IM GONNA TRY
this ROM
waiting for a
broken camera fix
soon
@vampirefo ive already been tweaking around for the camera , im getting newer logs that i never got on the port , ame accross this in the logs and found the patch for it.
links : https://gist.github.com/ishantvivek/ba0ec07f0e8cdf8ca3f2 and https://review.cyanogenmod.org/#/c/77502/
---------- Post added at 07:04 PM ---------- Previous post was at 06:33 PM ----------
Another error log regarding FlashLight:
01-02 19:58:03.044 842 842 E FlashlightController: Couldn't initialize.
01-02 19:58:03.044 842 842 E FlashlightController: android.hardware.camera2.CameraAccessException: CAMERA_ERROR (3): connectHelper:946: Failed to initialize camera "0": No such device (-19)
01-02 19:58:03.044 842 842 E FlashlightController: at android.hardware.camera2.CameraManager.throwAsPublicException(CameraManager.java:660)
01-02 19:58:03.044 842 842 E FlashlightController: at android.hardware.camera2.CameraManager.getOrCreateDeviceIdListLocked(CameraManager.java:717)
01-02 19:58:03.044 842 842 E FlashlightController: at android.hardware.camera2.CameraManager.getCameraIdList(CameraManager.java:98)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.policy.FlashlightController.getCameraId(FlashlightController.java:241)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.policy.FlashlightController.tryInitCamera(FlashlightController.java:108)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.policy.FlashlightController.addListener(FlashlightController.java:219)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.qs.tiles.FlashlightTile.<init>(FlashlightTile.java:48)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.QSTileHost.createTile(QSTileHost.java:428)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.QSTileHost.onTuningChanged(QSTileHost.java:344)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.tuner.TunerService.addTunable(TunerService.java:217)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.tuner.TunerService.addTunable(TunerService.java:193)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.QSTileHost.<init>(QSTileHost.java:154)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.SystemUIFactory.createQSTileHost(SystemUIFactory.java:114)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.PhoneStatusBar.makeStatusBarView(PhoneStatusBar.java:1054)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.PhoneStatusBar.addStatusBarWindow(PhoneStatusBar.java:3712)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.PhoneStatusBar.createAndAddWindows(PhoneStatusBar.java:3708)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.BaseStatusBar.start(BaseStatusBar.java:769)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.phone.PhoneStatusBar.start(PhoneStatusBar.java:793)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.SystemBars.createStatusBarFromConfig(SystemBars.java:106)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.SystemBars.onNoService(SystemBars.java:58)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.ServiceMonitor.startService(ServiceMonitor.java:230)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.ServiceMonitor.-wrap5(ServiceMonitor.java)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.systemui.statusbar.ServiceMonitor$1.handleMessage(ServiceMonitor.java:73)
01-02 19:58:03.044 842 842 E FlashlightController: at android.os.Handler.dispatchMessage(Handler.java:102)
01-02 19:58:03.044 842 842 E FlashlightController: at android.os.Looper.loop(Looper.java:154)
01-02 19:58:03.044 842 842 E FlashlightController: at android.app.ActivityThread.main(ActivityThread.java:6126)
01-02 19:58:03.044 842 842 E FlashlightController: at java.lang.reflect.Method.invoke(Native Method)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:886)
01-02 19:58:03.044 842 842 E FlashlightController: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:776)
01-02 19:58:03.044 842 842 E FlashlightController: Caused by: android.os.ServiceSpecificException: connectHelper:946: Failed to initialize camera "0": No such device (-19)
01-02 19:58:03.044 842 842 E FlashlightController: at android.os.Parcel.readException(Parcel.java:1698)
01-02 19:58:03.044 842 842 E FlashlightController: at android.os.Parcel.readException(Parcel.java:1637)
01-02 19:58:03.044 842 842 E FlashlightController: at android.hardware.ICameraService$Stub$Proxy.getCameraCharacteristics(ICameraService.java:404)
01-02 19:58:03.044 842 842 E FlashlightController: at android.hardware.camera2.CameraManager.getOrCreateDeviceIdListLocked(CameraManager.java:704)
01-02 19:58:03.044 842 842 E FlashlightController: ... 27 more
https://android.googlesource.com/platform/frameworks/base/+/fa81d21
@vampire in multitasking view the above display get stuck when you back to home
And still get hungs up and freezes
Due to High CPU usage
Rating next beta
G'DAY!!!
khyr said:
@vampire in multitasking view the above display get stuck when you back to home
And still get hungs up and freezes
Due to High CPU usage
Rating next beta
G'DAY!!!
Click to expand...
Click to collapse
Looks like you have a tweak enabled that affects the status bar, am I wrong?
Sent from my p6601 using Tapatalk
khyr said:
@vampire in multitasking view the above display get stuck when you back to home
And still get hungs up and freezes
Due to High CPU usage
Rating next beta
G'DAY!!!
Click to expand...
Click to collapse
Mine seems to be working just fine, I just use browser and Tapatalk, not watching video, I do change Governor and lower CPU if I am going to be multitasking for a while, short term I don't bother.
Sent from my Lineage OS R1HD by tapatalk
When I get a chance, I am going to try the camera wrapper and shim from.
https://github.com/jhalayashraj/android_device_oneplus_bacon?files=1
Haven't found anything for MTK yet, hopefully this is close enough to work for MTK.
Sent from my Lineage OS R1HD by tapatalk
has anyone ever found a fix for the viper4android not being able to use the busybox to install the driver?
---------- Post added at 12:32 PM ---------- Previous post was at 11:52 AM ----------
Hotspot does not work , in the port i had to switch the netd bin with one from Oleg's roms , but heres the patch he applied to his : https://github.com/olegsvs/android_device_archos_persimmon/tree/cm-14.1/patches/system_netd
KazuDante said:
has anyone ever found a fix for the viper4android not being able to use the busybox to install the driver?
---------- Post added at 12:32 PM ---------- Previous post was at 11:52 AM ----------
Hotspot does not work , in the port i had to switch the netd bin with one from Oleg's roms , but heres the patch he applied to his : https://github.com/olegsvs/android_device_archos_persimmon/tree/cm-14.1/patches/system_netd
Click to expand...
Click to collapse
That patch is already installed.
Sent from my Lineage OS R1HD by tapatalk
If you can quickly activate your hotspot and see if it does not show an error message instead of the ssid of the hotspot
Sent from my HTC6435LVW using Tapatalk
KazuDante said:
If you can quickly activate your hotspot and see if it does not show an error message instead of the ssid of the hotspot
Sent from my HTC6435LVW using Tapatalk
Click to expand...
Click to collapse
Ok, I will reapply the patch, when I can.
Sent from my Lineage OS R1HD by tapatalk
That can be dealt with another time since the camera is the one problem thats keeping this rom to step out of beta to at least an un-official build.
Sent from my HTC6435LVW using Tapatalk
Good stuff
FYI DeckerSU is just a rebase of MAD device tree ... Not your fault ...
One of the examples is this commit that everyone is now using ..
This came from us ..
People don't know or don't wanna use git cherry-pick .. probably to let other people think they are the commit author ,,,
oh well ..
https://github.com/vampirefo/android_device_blu_p6601/tree/master/libmtk_symbols
be sure you know how to use this ,,,
Whats the camera issue, no camera at all (pics/video) ?
Hotspot yeah its common.. needs some things to make it working
Kernel, your using stock MM prebuilt right? (bad idea)
Give me logs about camera and some last_ksmg
i had sold mine long ago
I'll have a look when i get some time ...
bb
edit: push to git your vendor ...
i'll do some builds + make it work with inline building.. and stuff
superdragonpt said:
Good stuff
FYI DeckerSU is just a rebase of MAD device tree ... Not your fault ...
One of the examples is this commit that everyone is now using ..
This came from us ..
People don't know or don't wanna use git cherry-pick .. probably to let other people think they are the commit author ,,,
oh well ..
https://github.com/vampirefo/android_device_blu_p6601/tree/master/libmtk_symbols
be sure you know how to use this ,,,
Whats the camera issue, no camera at all (pics/video) ?
Hotspot yeah its common.. needs some things to make it working
Kernel, your using stock MM prebuilt right? (bad idea)
Give me logs about camera and some last_ksmg
i had sold mine long ago
I'll have a look when i get some time ...
bb
edit: push to git your vendor ...
i'll do some builds + make it work with inline building.. and stuff
Click to expand...
Click to collapse
Camera, not being able to connect at all but in log camera module is loaded , will post log from my testing build , its slightly different , i added a few more libs to libshims to see if the logs would change.
Sent from my HTC6435LVW using Tapatalk
superdragonpt said:
Good stuff
FYI DeckerSU is just a rebase of MAD device tree ... Not your fault ...
One of the examples is this commit that everyone is now using ..
This came from us ..
People don't know or don't wanna use git cherry-pick .. probably to let other people think they are the commit author ,,,
oh well ..
https://github.com/vampirefo/android_device_blu_p6601/tree/master/libmtk_symbols
be sure you know how to use this ,,,
Whats the camera issue, no camera at all (pics/video) ?
Hotspot yeah its common.. needs some things to make it working
Kernel, your using stock MM prebuilt right? (bad idea)
Give me logs about camera and some last_ksmg
i had sold mine long ago
I'll have a look when i get some time ...
bb
edit: push to git your vendor ...
i'll do some builds + make it work with inline building.. and stuff
Click to expand...
Click to collapse
Thanks for the offer to help, it's appreciated
I just pushed vendor
https://github.com/vampirefo/android_vendor_blu_p6601
Camera just gives popup box error
Camera error
Can't connect to the camera.
Report Dismiss.
It will be a bit before I can get the logs wife using phone.
Perhaps @KazuDante or someone can get logs, i will get them when I get phone from wife, LOL.
Below are few additional steps.
DeckerSu requires a few extra things
[1] If the assembly you get out of memory error in the jack, then you need to do the following:
export JACK_SERVER_VM_ARGUMENTS = "- Dfile.encoding = UTF-8 -XX: + TieredCompilation -Xmx4096m" export ANDROID_JACK_VM_ARGS = "- Xmx4g -Dfile.encoding = UTF-8 -XX: + TieredCompilation" The $ HOME / .jack-server / config .properties put jack.server.max-service = 1.
Plus, I ran the assembly as make -j2 bacon, instead make -j5 bacon.
[2] Notes:
find. -type f -printf "% p \ n" - obtaining a list of files in a directory
Автор: Dimitry Ivanov <[email protected]> 2016-01-22 00:25:32
Коммитер: Dimitry Ivanov <[email protected]> 2016-01-22 03:43:04
Предок: 05c2f6b3d39ee92eae248e902a5a54fdcc6c696f (Merge "libc: hide __signalfd4 symbol")
Потомок: a42483baad9a37297e6bbbe02d433ecbde890386 (Merge "Revert "Temporary apply LIBC version to __pthread_gettid"")
Ветка: remotes/github/cm-14.1, remotes/m/cm-14.1
Следует за: android-sdk-adt_r12
Предшествует:
Revert "Temporary apply LIBC version to __pthread_gettid"
This reverts commit 0ef1d121b5e4845f4ef3b59ae9a1f99ceb531186.
Bug: http://b/26392296
Bug: http://b/26391427
Change-Id: I7bbb555de3a43813e7623ff6ad4e17874d283eca
Those. do apply LIBC version to __pthread_gettid.
** Required! ***
cd ~/cm14.1/bionic/libc/
git revert bba395492a0bb6ee72d0ad8e4d468e852392220e
[5] Add / proc / ged in FD whitelist in the frameworks / base / core / jni / fd_utils-inl.h
index 84252c0..2888064 100644
--- a/core/jni/fd_utils-inl.h
+++ b/core/jni/fd_utils-inl.h
@@ -58,6 +58,7 @@ static const char* kPathWhitelist[] = {
"/dev/ion",
"/dev/dri/renderD129", // Fixes b/31172436
"/system/framework/org.cyanogenmod.platform-res.apk",
+ "/proc/ged" // [+] Decker
#ifdef PATH_WHITELIST_EXTRA_H
PATH_WHITELIST_EXTRA_H
#endif
Again thank you for any help you can provide.
Here are the logs @superdragonpt
This one is simply opening the camera app ( not the built in Camu Camera App)
01-03 19:59:00.002 570 731 D lights : write_int open fd=-1
01-03 19:59:04.490 570 741 D lights : write_int open fd=-1
01-03 19:59:04.564 570 2634 I ActivityManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.android.camera2/com.android.camera.CameraLauncher bnds=[16,562][154,748] (has extras)} from uid 10085 on display 0
01-03 19:59:04.570 360 517 D AudioALSAStreamManager: +createPlaybackHandler(), mAudioMode = 0, output_devices = 0x2
01-03 19:59:04.570 360 517 D AudioYusuParam: QueryFeatureSupportInfo(),feature support 2290055
01-03 19:59:04.570 360 517 D AudioALSAPlaybackHandlerBase: AudioALSAPlaybackHandlerBase()
01-03 19:59:04.570 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerFast()
01-03 19:59:04.570 360 517 D AudioALSAStreamManager: createPlaybackHandler() ApplyFilter [1]/[2] Device [0x2]
01-03 19:59:04.570 360 517 D AudioALSAPlaybackHandlerFast: +setFilterMng() mAudioFilterManagerHandler [0xb59b9390]
01-03 19:59:04.570 360 517 D AudioALSAPlaybackHandlerFast: -setFilterMng()
01-03 19:59:04.570 360 517 D AudioALSAStreamManager: -createPlaybackHandler(), mPlaybackHandlerVector.size() = 1
01-03 19:59:04.570 360 517 D AudioALSAPlaybackHandlerFast: +open(), mDevice = 0x2
01-03 19:59:04.571 360 517 D AudioALSAHardwareResourceManager: EnableAudBufClk(), bEanble = 1, mStartOutputDevicesCount 0
01-03 19:59:04.571 360 517 D AudioALSADeviceParser: GetPcmIndexByString() stringpair = MultiMedia2_PLayback
01-03 19:59:04.571 360 517 D AudioALSADeviceParser: compare success = 24
01-03 19:59:04.571 360 517 D AudioALSADeviceParser: GetCardIndexByString() stringpair = MultiMedia2_PLayback
01-03 19:59:04.571 360 517 D AudioALSADeviceParser: compare success Cardindex = 0
01-03 19:59:04.571 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerNormal:pen() pcmindex = 24
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: Rate: min=8000Hz max=192000Hz
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: Channels: min=1 max=2
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: Sample bits: min=16 max=32
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: Period size: min=0 max=18432
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: Period count: min=1 max=4
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: PCM_PARAM_BUFFER_SIZE : max=18432
01-03 19:59:04.572 360 517 D AudioALSAPlaybackHandlerBase: PCM_PARAM_BUFFER_BYTES : max=36864
01-03 19:59:04.573 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerNormal:pen, mStreamAttributeTarget.buffer_size 36864
01-03 19:59:04.573 360 517 D AudioALSAPlaybackHandlerFast: ChooseTargetSampleRate SampleRate = 48000 outputdevice = 2
01-03 19:59:04.573 360 517 D AudioALSAPlaybackHandlerBase: transferAudioFormatToPcmFormat(), audio_format(0x4) => pcm_format(0x1)
01-03 19:59:04.573 360 517 D AudioALSAPlaybackHandlerFast: open(), mConfig: channels = 2, rate = 48000, period_size = 256, period_count = 2, format = 1, buffer size 4096 2048
01-03 19:59:04.573 360 517 D AudioALSAPlaybackHandlerBase: initBitConverter(), audio_format: 0x3 => 0x4, bcv_pcm_format = 0x3
01-03 19:59:04.573 360 517 D MtkAudioBitConverter: MtkAudioBitConverter Constructor, SR 48000, CH 2, format 3
01-03 19:59:04.574 360 517 D MtkAudioBitConverter: +Open()
01-03 19:59:04.574 360 517 D MtkAudioBitConverter: -Open()
01-03 19:59:04.574 360 517 D MtkAudioBitConverter: +ResetBuffer()
01-03 19:59:04.574 360 517 D MtkAudioBitConverter: -ResetBuffer()
01-03 19:59:04.574 360 517 D AudioALSAPlaybackHandlerFast: SetLowJitterMode() bEanble = 1 SampleRate = 48000
01-03 19:59:04.574 360 517 D AudioALSAPlaybackHandlerBase: +openPcmDriver(), pcm device = 24
01-03 19:59:04.575 360 517 E AudioALSAPlaybackHandlerBase: openPcmDriver(), pcm_start(0xb61322a0) fail due to cannot start channel: Broken pipe
01-03 19:59:04.576 360 517 D AudioALSAPlaybackHandlerBase: -openPcmDriver(), mPcm = 0xb61322a0
01-03 19:59:04.576 360 517 D AudioALSAHardwareResourceManager: +startOutputDevice(), new_devices = 0x2, mOutputDevices = 0x0, mStartOutputDevicesCount = 0 SampleRate = 48000
01-03 19:59:04.576 360 517 D AudioALSADriverUtility: GetPropertyValue key = af.resouce.extdac_support value = 0
01-03 19:59:04.576 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:04.576 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = headphone_output
01-03 19:59:04.576 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnonSequenceByName() DeviceName = headphone_output descriptor->DeviceStatusCounte = 0
01-03 19:59:04.576 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_R_Switch cltvalue = On
01-03 19:59:04.579 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_L_Switch cltvalue = On
01-03 19:59:04.579 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:04.579 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = ext_speaker_output
01-03 19:59:04.579 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnonSequenceByName() DeviceName = ext_speaker_output descriptor->DeviceStatusCounte = 0
01-03 19:59:04.579 360 517 D AudioALSADeviceConfigManager: cltname = Ext_Speaker_Amp_Switch cltvalue = On
01-03 19:59:04.633 32457 32457 V CAM_QuickActivity: START onCreate: Activity = [email protected]
01-03 19:59:04.633 32457 32457 V CAM_Profiler: [ 0.000ms][ui] GUARD: CameraActivity.onCreateTasks - START
01-03 19:59:04.633 32457 32457 D CAM_LocationManager: Using legacy location provider.
01-03 19:59:04.636 360 517 D AudioALSAHardwareResourceManager: -startOutputDevice(), mOutputDevices = 0x2, mStartOutputDevicesCount = 1
01-03 19:59:04.636 360 517 D AudioVoiceUIDL: [GetSRCInputParameter] mOutputSampleRate 16000, mInputSampleRate 48000, mInChannel 2, mOutChannel, 0 format 4
01-03 19:59:04.636 360 517 D AudioVoiceUIDL: [GetSRCInputParameter] create SRC handle fail
01-03 19:59:04.636 360 517 D AudioALSAPlaybackHandlerFast: -open()
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: AudioALSAVolumeController getMasterVolume
01-03 19:59:04.636 360 517 D AudioALSAStreamManager: setMasterVolume(), volume = 1.000000
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: AudioALSAVolumeController setMasterVolume v = 1.000000 mode = 0 devices = 0x2
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: ApplyExtAmpHeadPhoneGain Gain = 256 mode= 0 device = 3
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: DegradedBGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetLinoutRGain
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetRealLinoutRGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetLinoutRGain
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetRealLinoutRGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetHeadPhoneLGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetRealHeadPhoneLGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetHeadPhoneRGain = 0
01-03 19:59:04.636 360 517 D AudioALSAVolumeController: SetRealHeadPhoneRGain = 0
01-03 19:59:04.636 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 346L
01-03 19:59:04.636 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:04.636 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 443L
01-03 19:59:04.637 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:04.637 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 597L
01-03 19:59:04.637 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:04.637 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 678L
01-03 19:59:04.637 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:04.637 32457 32457 I CAM_OneCamFtrCnfgCrtr: CaptureModule? true
01-03 19:59:04.639 570 1283 I ActivityManager: START u0 {cmp=com.android.camera2/com.android.camera.PermissionsActivity} from uid 10047 on display 0
01-03 19:59:04.647 32457 32457 V CAM_CameraActivity: onCreate: Missing critical permissions.
01-03 19:59:04.648 570 1496 W ActivityManager: Duplicate finish request for ActivityRecord{c8cba8 u0 com.android.camera2/com.android.camera.CameraLauncher t95 f}
01-03 19:59:04.648 32457 32457 V CAM_QuickActivity: END onCreate: Activity = [email protected]
01-03 19:59:04.670 32457 32457 V CAM_QuickActivity: START onCreate: Activity = [email protected]
01-03 19:59:04.687 32457 32457 V CAM_QuickActivity: END onCreate: Activity = [email protected]
01-03 19:59:04.689 32457 32457 V CAM_QuickActivity: START onStart: Activity = [email protected]
01-03 19:59:04.689 32457 32457 V CAM_QuickActivity: END onStart: Activity = [email protected]
01-03 19:59:04.693 32457 32457 V CAM_QuickActivity: START onResume: Activity = [email protected]
01-03 19:59:04.694 32457 32457 V CAM_QuickActivity: onResume(): isKeyguardLocked() = false
01-03 19:59:04.695 32457 32457 V CAM_QuickActivity: onResume --> onResumeTasks()
01-03 19:59:04.720 32457 32457 V CAM_QuickActivity: END onResume: Activity = [email protected]
01-03 19:59:04.747 32457 32476 D mali_winsys: new_window_surface returns 0x3000
01-03 19:59:04.766 32457 32476 D mali_winsys: new_window_surface returns 0x3000
01-03 19:59:04.810 570 598 I ActivityManager: Displayed com.android.camera2/com.android.camera.PermissionsActivity: +147ms (total +205ms)
01-03 19:59:04.994 32457 32457 V CAM_QuickActivity: START onDestroy: Activity = [email protected]
01-03 19:59:04.997 32457 32457 V CAM_QuickActivity: END onDestroy: Activity = [email protected]
01-03 19:59:05.024 347 347 W SurfaceFlinger: couldn't log to binary event log: overflow.
01-03 19:59:07.781 360 517 D AudioALSAPlaybackHandlerFast: +close()
01-03 19:59:07.781 360 517 D AudioVoiceUIDL: [SetInputStandBy] ReadRefFromRing to exit? (0)
01-03 19:59:07.781 360 517 D AudioALSAHardwareResourceManager: +stopOutputDevice(), mOutputDevices = 0x2, mStartOutputDevicesCount = 1
01-03 19:59:07.781 360 517 D AudioALSAHardwareResourceManager: CloseSpeakerPath(), AUDIO_DEVICE_OUT_SPEAKER
01-03 19:59:07.781 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:07.782 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = ext_speaker_output
01-03 19:59:07.782 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnoffSequenceByName() DeviceName = ext_speaker_output descriptor->DeviceStatusCounte = 1
01-03 19:59:07.782 360 517 D AudioALSADeviceConfigManager: cltname = Ext_Speaker_Amp_Switch cltvalue = Off
01-03 19:59:07.783 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:07.783 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = headphone_output
01-03 19:59:07.783 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnoffSequenceByName() DeviceName = headphone_output descriptor->DeviceStatusCounte = 1
01-03 19:59:07.783 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_R_Switch cltvalue = Off
01-03 19:59:07.783 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_L_Switch cltvalue = Off
01-03 19:59:07.785 360 517 D AudioALSADriverUtility: GetPropertyValue key = af.resouce.extdac_support value = 0
01-03 19:59:07.785 360 517 D AudioALSAHardwareResourceManager: -stopOutputDevice(), mOutputDevices = 0x0, mStartOutputDevicesCount = 0
01-03 19:59:07.786 360 517 D AudioALSAPlaybackHandlerBase: +closePcmDriver(), mPcm = 0xb61322a0
01-03 19:59:07.787 360 517 D AudioALSAPlaybackHandlerBase: -closePcmDriver(), mPcm = 0x0
01-03 19:59:07.788 360 517 D AudioALSAPlaybackHandlerFast: SetLowJitterMode() bEanble = 0 SampleRate = 48000
01-03 19:59:07.788 360 517 D AudioALSAPlaybackHandlerBase: DeinitDataPending
01-03 19:59:07.788 360 517 D AudioALSAPlaybackHandlerBase: delete mdataPendingTempBuffer
01-03 19:59:07.788 360 517 D MtkAudioBitConverter: +Close()
01-03 19:59:07.788 360 517 D MtkAudioBitConverter: -Close()
01-03 19:59:07.788 360 517 D MtkAudioBitConverter: +~MtkAudioBitConverter()
01-03 19:59:07.788 360 517 D MtkAudioBitConverter: -~MtkAudioBitConverter()
01-03 19:59:07.788 360 517 D AudioALSAHardwareResourceManager: EnableAudBufClk(), bEanble = 0, mStartOutputDevicesCount 0
01-03 19:59:07.796 360 517 D AudioALSAPlaybackHandlerFast: -close()
01-03 19:59:07.796 360 517 D AudioALSAStreamManager: +destroyPlaybackHandler(), mode = 0, pPlaybackHandler = 0xb5298600
01-03 19:59:07.796 360 517 D AudioALSAPlaybackHandlerFast: ~AudioALSAPlaybackHandlerFast()
01-03 19:59:07.797 360 517 D AudioALSAPlaybackHandlerBase: ~AudioALSAPlaybackHandlerBase()
01-03 19:59:07.797 360 517 D AudioALSAStreamManager: -destroyPlaybackHandler(), mPlaybackHandlerVector.size() = 0
01-03 19:59:08.559 360 517 D AudioALSAStreamManager: +createPlaybackHandler(), mAudioMode = 0, output_devices = 0x2
01-03 19:59:08.559 360 517 D AudioYusuParam: QueryFeatureSupportInfo(),feature support 2290055
01-03 19:59:08.559 360 517 D AudioALSAPlaybackHandlerBase: AudioALSAPlaybackHandlerBase()
01-03 19:59:08.559 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerFast()
01-03 19:59:08.559 360 517 D AudioALSAStreamManager: createPlaybackHandler() ApplyFilter [1]/[2] Device [0x2]
01-03 19:59:08.559 360 517 D AudioALSAPlaybackHandlerFast: +setFilterMng() mAudioFilterManagerHandler [0xb59b9390]
01-03 19:59:08.559 360 517 D AudioALSAPlaybackHandlerFast: -setFilterMng()
01-03 19:59:08.559 360 517 D AudioALSAStreamManager: -createPlaybackHandler(), mPlaybackHandlerVector.size() = 1
01-03 19:59:08.559 360 517 D AudioALSAPlaybackHandlerFast: +open(), mDevice = 0x2
01-03 19:59:08.559 360 517 D AudioALSAHardwareResourceManager: EnableAudBufClk(), bEanble = 1, mStartOutputDevicesCount 0
01-03 19:59:08.566 360 517 D AudioALSADeviceParser: GetPcmIndexByString() stringpair = MultiMedia2_PLayback
01-03 19:59:08.566 360 517 D AudioALSADeviceParser: compare success = 24
01-03 19:59:08.566 360 517 D AudioALSADeviceParser: GetCardIndexByString() stringpair = MultiMedia2_PLayback
01-03 19:59:08.566 360 517 D AudioALSADeviceParser: compare success Cardindex = 0
01-03 19:59:08.566 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerNormal:pen() pcmindex = 24
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: Rate: min=8000Hz max=192000Hz
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: Channels: min=1 max=2
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: Sample bits: min=16 max=32
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: Period size: min=0 max=18432
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: Period count: min=1 max=4
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: PCM_PARAM_BUFFER_SIZE : max=18432
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: PCM_PARAM_BUFFER_BYTES : max=36864
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerFast: AudioALSAPlaybackHandlerNormal:pen, mStreamAttributeTarget.buffer_size 36864
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerFast: ChooseTargetSampleRate SampleRate = 48000 outputdevice = 2
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: transferAudioFormatToPcmFormat(), audio_format(0x4) => pcm_format(0x1)
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerFast: open(), mConfig: channels = 2, rate = 48000, period_size = 256, period_count = 2, format = 1, buffer size 4096 2048
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: initBitConverter(), audio_format: 0x3 => 0x4, bcv_pcm_format = 0x3
01-03 19:59:08.567 360 517 D MtkAudioBitConverter: MtkAudioBitConverter Constructor, SR 48000, CH 2, format 3
01-03 19:59:08.567 360 517 D MtkAudioBitConverter: +Open()
01-03 19:59:08.567 360 517 D MtkAudioBitConverter: -Open()
01-03 19:59:08.567 360 517 D MtkAudioBitConverter: +ResetBuffer()
01-03 19:59:08.567 360 517 D MtkAudioBitConverter: -ResetBuffer()
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerFast: SetLowJitterMode() bEanble = 1 SampleRate = 48000
01-03 19:59:08.567 360 517 D AudioALSAPlaybackHandlerBase: +openPcmDriver(), pcm device = 24
01-03 19:59:08.569 360 517 E AudioALSAPlaybackHandlerBase: openPcmDriver(), pcm_start(0xb61322a0) fail due to cannot start channel: Broken pipe
01-03 19:59:08.569 360 517 D AudioALSAPlaybackHandlerBase: -openPcmDriver(), mPcm = 0xb61322a0
01-03 19:59:08.569 360 517 D AudioALSAHardwareResourceManager: +startOutputDevice(), new_devices = 0x2, mOutputDevices = 0x0, mStartOutputDevicesCount = 0 SampleRate = 48000
01-03 19:59:08.569 360 517 D AudioALSADriverUtility: GetPropertyValue key = af.resouce.extdac_support value = 0
01-03 19:59:08.569 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:08.569 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = headphone_output
01-03 19:59:08.569 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnonSequenceByName() DeviceName = headphone_output descriptor->DeviceStatusCounte = 0
01-03 19:59:08.569 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_R_Switch cltvalue = On
01-03 19:59:08.572 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_L_Switch cltvalue = On
01-03 19:59:08.572 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:08.572 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = ext_speaker_output
01-03 19:59:08.572 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnonSequenceByName() DeviceName = ext_speaker_output descriptor->DeviceStatusCounte = 0
01-03 19:59:08.572 360 517 D AudioALSADeviceConfigManager: cltname = Ext_Speaker_Amp_Switch cltvalue = On
01-03 19:59:08.608 32457 32457 V CAM_QuickActivity: START onPause: Activity = [email protected]
01-03 19:59:08.608 32457 32457 V CAM_QuickActivity: onPause --> onPauseTasks()
01-03 19:59:08.608 32457 32457 V CAM_QuickActivity: END onPause: Activity = [email protected]
01-03 19:59:08.626 360 517 D AudioALSAHardwareResourceManager: -startOutputDevice(), mOutputDevices = 0x2, mStartOutputDevicesCount = 1
01-03 19:59:08.626 360 517 D AudioVoiceUIDL: [GetSRCInputParameter] mOutputSampleRate 16000, mInputSampleRate 48000, mInChannel 2, mOutChannel, 0 format 4
01-03 19:59:08.626 360 517 D AudioVoiceUIDL: [GetSRCInputParameter] create SRC handle fail
01-03 19:59:08.626 360 517 D AudioALSAPlaybackHandlerFast: -open()
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: AudioALSAVolumeController getMasterVolume
01-03 19:59:08.626 360 517 D AudioALSAStreamManager: setMasterVolume(), volume = 1.000000
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: AudioALSAVolumeController setMasterVolume v = 1.000000 mode = 0 devices = 0x2
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: ApplyExtAmpHeadPhoneGain Gain = 256 mode= 0 device = 3
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: DegradedBGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetLinoutRGain
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetRealLinoutRGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetLinoutRGain
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetRealLinoutRGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetHeadPhoneLGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetRealHeadPhoneLGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetHeadPhoneRGain = 0
01-03 19:59:08.626 360 517 D AudioALSAVolumeController: SetRealHeadPhoneRGain = 0
01-03 19:59:08.626 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 346L
01-03 19:59:08.627 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:08.627 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 443L
01-03 19:59:08.627 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:08.627 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 597L
01-03 19:59:08.627 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:08.627 360 517 E AudioALSAPlaybackHandlerBase: ASSERT(*ppOutBuffer != NULL && *pOutBytes != 0) fail: "vendor/mediatek/proprietary/hardware/audio/mt6735/../common/V3/aud_drv/AudioALSAPlaybackHandlerBase.cpp", 678L
01-03 19:59:08.627 360 517 E AEE/LIBAEE: shell: cant create socket with aed: Connection refused
01-03 19:59:08.710 27577 27599 D mali_winsys: new_window_surface returns 0x3000
01-03 19:59:08.758 570 2634 W InputMethodManagerService: Window already focused, ignoring focus gain of: [email protected] attribute=null, token = [email protected]
01-03 19:59:08.874 32457 32457 V CAM_QuickActivity: START onStop: Activity = [email protected]
01-03 19:59:08.874 32457 32457 V CAM_QuickActivity: END onStop: Activity = [email protected]
01-03 19:59:08.874 32457 32457 V CAM_QuickActivity: START onDestroy: Activity = [email protected]
01-03 19:59:08.874 32457 32457 V CAM_PermissionsActivity: onDestroy: unregistering receivers
01-03 19:59:08.875 32457 32457 V CAM_QuickActivity: END onDestroy: Activity = [email protected]
01-03 19:59:09.231 27577 27599 W OpenGLRenderer: Incorrectly called buildLayer on View: ShortcutAndWidgetContainer, destroying layer...
01-03 19:59:11.751 360 517 D AudioALSAPlaybackHandlerFast: +close()
01-03 19:59:11.752 360 517 D AudioVoiceUIDL: [SetInputStandBy] ReadRefFromRing to exit? (0)
01-03 19:59:11.752 360 517 D AudioALSAHardwareResourceManager: +stopOutputDevice(), mOutputDevices = 0x2, mStartOutputDevicesCount = 1
01-03 19:59:11.752 360 517 D AudioALSAHardwareResourceManager: CloseSpeakerPath(), AUDIO_DEVICE_OUT_SPEAKER
01-03 19:59:11.752 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:11.752 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = ext_speaker_output
01-03 19:59:11.752 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnoffSequenceByName() DeviceName = ext_speaker_output descriptor->DeviceStatusCounte = 1
01-03 19:59:11.752 360 517 D AudioALSADeviceConfigManager: cltname = Ext_Speaker_Amp_Switch cltvalue = Off
01-03 19:59:11.753 360 517 D AudioALSADeviceConfigManager: GetDeviceDescriptorbyname
01-03 19:59:11.753 360 517 D AudioALSADeviceConfigManager: CheckDeviceExist exist devicename = headphone_output
01-03 19:59:11.753 360 517 D AudioALSADeviceConfigManager: ApplyDeviceTurnoffSequenceByName() DeviceName = headphone_output descriptor->DeviceStatusCounte = 1
01-03 19:59:11.753 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_R_Switch cltvalue = Off
01-03 19:59:11.754 360 517 D AudioALSADeviceConfigManager: cltname = Audio_Amp_L_Switch cltvalue = Off
01-03 19:59:11.756 360 517 D AudioALSADriverUtility: GetPropertyValue key = af.resouce.extdac_support value = 0
01-03 19:59:11.756 360 517 D AudioALSAHardwareResourceManager: -stopOutputDevice(), mOutputDevices = 0x0, mStartOutputDevicesCount = 0
01-03 19:59:11.756 360 517 D AudioALSAPlaybackHandlerBase: +closePcmDriver(), mPcm = 0xb61322a0
01-03 19:59:11.758 360 517 D AudioALSAPlaybackHandlerBase: -closePcmDriver(), mPcm = 0x0
01-03 19:59:11.758 360 517 D AudioALSAPlaybackHandlerFast: SetLowJitterMode() bEanble = 0 SampleRate = 48000
01-03 19:59:11.758 360 517 D AudioALSAPlaybackHandlerBase: DeinitDataPending
01-03 19:59:11.759 360 517 D AudioALSAPlaybackHandlerBase: delete mdataPendingTempBuffer
01-03 19:59:11.759 360 517 D MtkAudioBitConverter: +Close()
01-03 19:59:11.759 360 517 D MtkAudioBitConverter: -Close()
01-03 19:59:11.759 360 517 D MtkAudioBitConverter: +~MtkAudioBitConverter()
01-03 19:59:11.759 360 517 D MtkAudioBitConverter: -~MtkAudioBitConverter()
01-03 19:59:11.759 360 517 D AudioALSAHardwareResourceManager: EnableAudBufClk(), bEanble = 0, mStartOutputDevicesCount 0
01-03 19:59:11.767 360 517 D AudioALSAPlaybackHandlerFast: -close()
01-03 19:59:11.767 360 517 D AudioALSAStreamManager: +destroyPlaybackHandler(), mode = 0, pPlaybackHandler = 0xb5298600
01-03 19:59:11.767 360 517 D AudioALSAPlaybackHandlerFast: ~AudioALSAPlaybackHandlerFast()
01-03 19:59:11.767 360 517 D AudioALSAPlaybackHandlerBase: ~AudioALSAPlaybackHandlerBase()
01-03 19:59:11.767 360 517 D AudioALSAStreamManager: -destroyPlaybackHandler(), mPlaybackHandlerVector.size() = 0
01-03 19:59:16.771 570 600 D lights : write_int open fd=-1
these are the camu app logs....next i will do the full log during boot-up. @superdragonpt
and here are the kmsg @superdragonpt
KazuDante said:
and here are the kmsg @superdragonpt
Click to expand...
Click to collapse
Go to sleep man he he

Huawei Mate SE Google Maps can't detect location. Don't know why.

I'm having problems with my phone, on my Mate SE I have Magisk, the modules I installed are 1Controller, AdguardDNS AdBlocker, Busybox for android NDK, Exo2 Font, Global Optimized GPS File Replacer, Greenify4Magisk, and iOS12.2 Emoji.
Apps I have that also may cause this error. Substratum, VPN, Lucky Patcher, Google Maps, Modded Playstore, Magisk Manager, etc.
ROM: Open kirin Resurrection Remix OS beta 3
Kernel: Elemental v5.8 (2018-10-16)
Error: Every GPS app I have can't detect my location. I have root, and high accuracy on. I tried changing the gps.conf file with Global Optimized GPS File Replacer but no luck. I press the view my location button and nothing happens. Maybe the root apps or modules I have don't work with maps. Also before this error occurred, it got stuck on finding best route.
Logcat:
--------- beginning of main
12-02 00:28:02.773 1808 1808 W ChimeraUtils: Non Chimera context
12-02 00:28:02.773 1808 1808 W ChimeraUtils: Non Chimera context
12-02 00:28:03.105 8464 8474 I zygote64: Background concurrent copying GC freed 379279(15MB) AllocSpace objects, 91(4MB) LOS objects, 50% free, 11MB/23MB, paused 164us total 195.122ms
12-02 00:28:13.735 1036 1268 D AudioService: Stream muted, skip playback
12-02 00:28:13.759 1036 1833 I WifiService: getWifiEnabledState uid=10022
12-02 00:28:13.759 1036 1833 I WifiService: isScanAlwaysAvailable uid=10022
12-02 00:28:14.452 1036 1268 D AudioService: Stream muted, skip playback
12-02 00:28:14.468 1036 1611 I WifiService: getWifiEnabledState uid=10022
12-02 00:28:14.470 1036 1611 I WifiService: isScanAlwaysAvailable uid=10022
12-02 00:28:15.075 1036 1268 D AudioService: Stream muted, skip playback
12-02 00:28:15.100 1036 1833 I WifiService: getWifiEnabledState uid=10022
12-02 00:28:15.101 1036 1833 I WifiService: isScanAlwaysAvailable uid=10022
12-02 00:28:15.589 1036 1268 D AudioService: Stream muted, skip playback
12-02 00:28:15.605 1036 1611 I WifiService: getWifiEnabledState uid=10022
12-02 00:28:15.606 1036 1611 I WifiService: isScanAlwaysAvailable uid=10022
12-02 00:28:16.060 1036 1268 D AudioService: Stream muted, skip playback
12-02 00:28:16.086 1036 1611 I WifiService: getWifiEnabledState uid=10022
12-02 00:28:16.086 1036 1611 I WifiService: isScanAlwaysAvailable uid=10022
12-02 00:28:16.125 537 537 I GRALLOC : shrFd=10,fmt=0x1,intFmt=0x200000001,btStrd=4352,size=9547776,pid=537
12-02 00:28:16.125 537 537 I GRALLOC : yuv=2,w=1080,h=2160,Stride u=0 v=0,offset u=0 v=0
12-02 00:28:16.125 537 537 I GRALLOC : iova_size=9547776,conUsg=0xb00,proUsg=0xb00, strd=1088,[afbc]HdrStrd=1088 PyldStrd=69632 Scrmbl=0,ionhnd = 1
--------- beginning of system
12-02 00:28:19.724 1036 1068 E BatteryExternalStatsWorker: modem info is invalid: ModemActivityInfo{ mTimestamp=0 mSleepTimeMs=0 mIdleTimeMs=0 mTxTimeMs[]=[0, 0, 0, 0, 0] mRxTimeMs=0 mEnergyUsed=0}
12-02 00:28:25.570 1374 1374 D HeadsetPhoneState: sendDeviceStateChanged. mService=1 mIsSimStateLoaded=true mSignal=5 mRoam=0 mBatteryCharge=5
12-02 00:28:27.211 6711 6711 I .android.chrome: type=1400 audit(0.0:566): avc: denied { read } for name="vmstat" dev="proc" ino=4026532162 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=ubject_rroc:s0 tclass=file permissive=1
12-02 00:28:27.211 6711 6711 I .android.chrome: type=1400 audit(0.0:567): avc: denied { open } for path="/proc/vmstat" dev="proc" ino=4026532162 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=ubject_rroc:s0 tclass=file permissive=1
12-02 00:28:27.211 6711 6711 I .android.chrome: type=1400 audit(0.0:568): avc: denied { getattr } for path="/proc/vmstat" dev="proc" ino=4026532162 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=ubject_rroc:s0 tclass=file permissive=1
12-02 00:28:29.917 1374 1374 D HeadsetPhoneState: sendDeviceStateChanged. mService=1 mIsSimStateLoaded=true mSignal=4 mRoam=0 mBatteryCharge=5
12-02 00:28:44.574 12097 12114 I Finsky : [111] com.google.android.finsky.bo.ad.run(6): Stats for Executor: BlockingExecutor [email protected][Running, pool size = 0, active threads = 0, queued tasks = 0, completed tasks = 7]
12-02 00:28:44.575 12097 12114 I Finsky : [111] com.google.android.finsky.bo.ad.run(6): Stats for Executor: LightweightExecutor [email protected][Running, pool size = 4, active threads = 0, queued tasks = 0, completed tasks = 44]
12-02 00:28:44.697 12097 12114 I Finsky : [111] com.google.android.finsky.bo.ad.run(6): Stats for Executor: bgExecutor [email protected][Running, pool size = 4, active threads = 0, queued tasks = 0, completed tasks = 10]
bump, please someone help

Xperia 1 - DRM keys back after locking the bootloader ?

Hello,
I just have a question, my Xperia 1 was unlocked and rooted (magisk) on Android 10.
Yesterday, I decided to lock the bootloader, everything was erased from the phone after that. The new Android installation was buggy so I tried to restore the phone using Xperia Companion.
After the restore using Xperia Companion, Now everything is working fine and I was really surprised, my DRM keys are back, I have "L1" using the DRM info app and I can watch Netflix HD content and Amazon Prime Video HD content.
How is that possible ? I thought that by unlocking the bootloader, the DRM keys are lost forever ?
Hmmm do you have any proof?
Hello,
Yes, please see my old messages, I succesfully unlocked ans rooted the device. Now see the screenshot below.
https://ibb.co/7RH2ZdG
Check with *#*#7378423#*#*
Then service info>security
Then see if any ........XXXXX error and share the screenshot.
Thanks
Hello, thanks for your Reply.
It seems that there is No error, but I have confirmation that thé device has already be unlocked
https://imgshare.io/image/screenshot-20200412-1650532.4yP8t
By thé way, i also recieved an OTAsoftware uppgrade. So this is now working too.
titigunner01 said:
By thé way, i also recieved an OTAsoftware uppgrade. So this is now working too.
Click to expand...
Click to collapse
You can receive OTA if you have just locked the bootloader.
But the things in Screenshot looks great. It was a previous way of checking the DRM keys and I don't know if only these things verify the DRM keys in latest versions too.
Is it a matter that the phone restores the DRM under locked bootloader again in Sony or did they remove the DRMs?
But what it matters is you are using apps and things like you have the DRM so may be thats good.:good:
So, after you restored stock ROM, also the boot message "can't be checked for corruption" is gone?
Yes, no message when booting.
Very strange, i wanted to know if everyone else noticed thé same thing.
titigunner01 said:
Yes, no message when booting.
Very strange, i wanted to know if everyone else noticed thé same thing.
Click to expand...
Click to collapse
Eventually I will try on my Xperia 10 II. Hope I have the same luck, thanks!
titigunner01 said:
Hello,
I just have a question, my Xperia 1 was unlocked and rooted (magisk) on Android 10.
Yesterday, I decided to lock the bootloader, everything was erased from the phone after that. The new Android installation was buggy so I tried to restore the phone using Xperia Companion.
After the restore using Xperia Companion, Now everything is working fine and I was really surprised, my DRM keys are back, I have "L1" using the DRM info app and I can watch Netflix HD content and Amazon Prime Video HD content.
How is that possible ? I thought that by unlocking the bootloader, the DRM keys are lost forever ?
Click to expand...
Click to collapse
did you lock the bootloader with flashtool?
I just want to do it too, but can`t I find a guide for xperia 1
No i locked the bootloader using command lines.
Maybe this will work also using Flashtool, Im not sure.
titigunner01 said:
No i locked the bootloader using command lines.
Maybe this will work also using Flashtool, Im not sure.
Click to expand...
Click to collapse
you using this commands?
fastboot oem lock
fastboot flashing lock
fastboot oem relock
fastboot reboot
if not, can you describe step by step how you did it?
I will
thankful to you!
Hello,
Yes, if I remember well, on fastboot mode, i used fastboot oem lock.
After the reboot of the phone, everything was reased. The new installation was really buggy so after that I recovered using Xperia Companion.
interesting - I am wondering if sony still uses the device key in TA 66667 unit and if it gets erased with the first unlock or not.
Deleted
Relock the bootloader, repair with xperia companion and drm keys are back.
Only on xperia 1, 5 and up !
Beware: even though it may look all keys are back, it is still questionable if some function/feature is not permanently missing.
I did some research and it seems xperia 1 bootloader ABL does erase device key, i.e. TA 66667 (0x1046b) unit, on unlock.
So in my opinion even though you can relock and everything looks normal, the device key gets never back.
The question is what (drm) functions are connected to it.
Here more details:
Just extracted abl from J9110_10_55.1.A.0.748_PLUSPL, posted it here:
xperia-1-J9110-55.1.A.0.748-LA2_0_Q_114-ABL-LinuxLoader.zip
Just observing the strings in it, I am not trusting SONY at all with the re-lock of xperia-1:
Code:
$ strings -a LA2_0_Q_114-ABL-LinuxLoader.pe | grep -i 'device key\|[ _]dk'
Size of device key is too large (%d > %d)
Device key is not set, setting to zero
get_dk returned err=%d
Unable to delete dk
get_hwconf_dk returned err=%d
Device Key MiscTA unit size is zero
Failed to allocate memory for Device Key
Device keys not of equal length!
hwconf_x_parser_get_hwc_dk returned err=%d
Device Key length in HWConfig is zero
Failed to get size of TA_DK_NUMBER_UNIT
Failed to delete DK
This looks very similar to stuff implemented in xz1c ABL related to unlock and TA unit 66667 (0x1046b) containing the device key erased with bootloader unlock!
You may also observe if the message "Device key is not set, setting to zero" is present in bootloader log that is stored in 0x802 TA unit (and few other following units containing older boots).
It would be interesting to test TA backup, unlock, relock, TA restore, so that device key would be back.
This tells everything:
From i d a can't see 1046b but see the same function at the bottom (ghidra output)
Code:
void sub_4DDE4()
{
int v0; // w0
__int64 v1; // x3
__int64 v2; // x4
__int64 v3; // x5
__int64 v4; // x6
__int64 v5; // x7
__int64 v6; // x0
__int64 v7; // x1
const char *v8; // x0
__int64 v9; // x2
__int64 v10; // x0
char v11; // zf
int v12; // w0
__int64 v13; // x0
__int64 v14; // x0
unsigned int v15; // w1
__int64 v16; // x2
__int64 v17; // x3
_DWORD *v18; // x4
__int64 v19; // x5
__int64 v20; // x6
__int64 v21; // x7
signed int v22; // [xsp+4h] [xbp-2Ch]
sub_440B4();
if ( v0 )
{
sub_4DF70();
v7 = v6;
v8 = "[ERROR @ %s:%d]:\nFailed to get size of TA_DK_NUMBER_UNIT\n";
v9 = 303i64;
}
else
{
if ( v22 < 1 )
goto LABEL_4;
sub_44318();
if ( !v12 )
goto LABEL_4;
sub_4DF70();
v7 = v13;
v8 = "[ERROR @ %s:%d]:\nFailed to delete DK\n";
v9 = 310i64;
}
sub_589A0(v8, v7, v9, v1, v2, v3, v4, v5);
LABEL_4:
sub_4DF5C();
if ( !v11 )
{
sub_14468(v10);
sub_4DE94(v14, v15, v16, v17, v18, v19, v20, v21);
}
}
Code:
sub_4110C();
[B][COLOR="Red"]sub_4DDE4();[/COLOR][/B]
if ( v0 )
{
sub_41100();
sub_589A0("[ERROR @ %s:%d]:\nUnable to delete dk\n", v1, 1438i64, v2, v3, v4, v5, v6);
goto LABEL_10;
}
sub_3ED48();
if ( !v7 )
{
sub_41100();
sub_589A0("[ERROR @ %s:%d]:\nFailed to delete user sensitive partitions\n", v18, 1443i64, v19, v20, v21, v22, v23);
goto LABEL_10;
}
sub_3EE20();
if ( v8 )
{
sub_41100();
v15 = v14;
v16 = "[ERROR @ %s:%d]:\nFailed to reset rollback counters, error:%d\n";
v17 = 1451i64;
}
else
{
sub_3EDF0();
if ( !v24 )
goto LABEL_10;
sub_41100();
v15 = v25;
v16 = "[ERROR @ %s:%d]:\n[B][COLOR="Red"]Failed to lock the bootloader: [/COLOR][/B]%d\n";
v17 = 1457i64;
}
ghidra
Code:
ulonglong FUN_0005dde4(void)
{
bool in_ZR;
undefined uVar1;
ulonglong uVar2;
undefined8 extraout_x0;
undefined8 local_28;
undefined8 extraout_x0_00;
undefined8 uVar3;
undefined *puVar4;
undefined uVar5;
undefined8 in_x3;
undefined7 uVar6;
undefined uVar7;
undefined8 in_x4;
undefined7 uVar8;
undefined uVar9;
undefined8 in_x5;
undefined7 uVar10;
undefined uVar11;
undefined8 in_x6;
undefined7 uVar12;
undefined uVar13;
undefined8 in_x7;
undefined7 uVar14;
ulonglong uVar15;
undefined in_stack_ffffffffffffffd0;
undefined uVar16;
int local_2c;
uVar14 = (undefined7)((ulonglong)in_x7 >> 8);
uVar13 = (undefined)in_x7;
uVar12 = (undefined7)((ulonglong)in_x6 >> 8);
uVar11 = (undefined)in_x6;
uVar10 = (undefined7)((ulonglong)in_x5 >> 8);
uVar9 = (undefined)in_x5;
uVar8 = (undefined7)((ulonglong)in_x4 >> 8);
uVar7 = (undefined)in_x4;
uVar6 = (undefined7)((ulonglong)in_x3 >> 8);
uVar5 = (undefined)in_x3;
puVar4 = &stack0xffffffffffffffd4;
uVar3 = 0x1046b;
local_28 = DAT_000a90c0;
uVar2 = FUN_000540b4(2);
uVar16 = (undefined)local_2c;
uVar1 = (undefined)uVar2;
if ((int)uVar2 == 0) {
in_ZR = local_2c == 1;
if (local_2c < 1) {
uVar15 = 0;
goto LAB_0005de34;
}
[COLOR="Blue"][B] uVar3 = 0x1046b; // drm key unit[/B][/COLOR]
[COLOR="Red"] uVar2 = FUN_00054318(2); // partition 2
uVar1 = (undefined)uVar2;
uVar15 = uVar2 & 0xffffffff;
if ((int)uVar2 == 0) goto LAB_0005de34;
FUN_0005df70(uVar2,uVar3,puVar4,CONCAT71(uVar6,uVar5),CONCAT71(uVar8,uVar7),
CONCAT71(uVar10,uVar9),CONCAT71(uVar12,uVar11),CONCAT71(uVar14,uVar13));
_uVar1 = "[ERROR @ %s:%d]:\nFailed to delete DK\n";[/COLOR]
puVar4 = (undefined *)0x136;
uVar3 = extraout_x0_00;
}
else {
uVar15 = uVar2 & 0xffffffff;
FUN_0005df70(uVar2,uVar3,puVar4,CONCAT71(uVar6,uVar5),CONCAT71(uVar8,uVar7),
CONCAT71(uVar10,uVar9),CONCAT71(uVar12,uVar11),CONCAT71(uVar14,uVar13));
_uVar1 = "[ERROR @ %s:%d]:\nFailed to get size of TA_DK_NUMBER_UNIT\n";
puVar4 = (undefined *)0x12f;
uVar3 = extraout_x0;
}
uVar1 = FUN_000689a0(_uVar1,uVar3,puVar4,CONCAT71(uVar6,uVar5),CONCAT71(uVar8,uVar7),
CONCAT71(uVar10,uVar9),CONCAT71(uVar12,uVar11),CONCAT71(uVar14,uVar13));
LAB_0005de34:
local_28 = FUN_0005df5c(uVar1,(char)uVar3,(char)puVar4,uVar5,uVar7,uVar9,uVar11,uVar13,
in_stack_ffffffffffffffd0,uVar16,local_28);
if (in_ZR) {
return uVar15;
}
// WARNING: Subroutine does not return
FUN_00024468(local_28,uVar3,puVar4,CONCAT71(uVar6,uVar5),CONCAT71(uVar8,uVar7),
CONCAT71(uVar10,uVar9),CONCAT71(uVar12,uVar11),CONCAT71(uVar14,uVar13));
}
Its very evidently that function sub_4DDE4 is called at the start of lock function, I can tell that drm key is bye bye after you unlock phone, curently I'm unable to figure out what is done with oem lock command & why widevine keys is back but definitelly drm key is lost forever, indication for that is message inside service menu "is even unlocked = yes" !
So how lock is done, in short:
1. drm key bye bye
2. user sensitive partitions deleted (thats why device no more boot & must use sony pc companion in order to repair)
3. rollback counter reset
4. bootloader locked
Some good news for bootloader unlocked xperia 10 owners! I'm managed to get all back after patching secd
Code:
07-25 17:10:29.745 8470 8471 I [email protected]: start init_thread
07-25 17:10:29.745 8470 8471 I [email protected]: listeners registered
07-25 17:10:29.745 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x200
07-25 17:10:29.746 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.746 579 579 I SELinux : avc: received setenforce notice (enforcing=0)
07-25 17:10:29.747 579 579 W hwservicemanager: Detected instance of [email protected]::IDeviceSecurity (pid: 8470) registering over instance of or with base of [email protected]::IDeviceSecurity (pid: 879).
07-25 17:10:29.751 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.751 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.752 8470 8471 I libdevice_security_static: get_rooting_status.cpp:80 rooting_status 0
07-25 17:10:29.752 8470 8471 I [email protected]: the bootloader is OK, try to init suntory
07-25 17:10:29.752 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2022
07-25 17:10:29.754 8470 8471 I libsuntory_static: utils_blob.cpp:497 found blob CKB
07-25 17:10:29.754 8470 8471 I libsuntory_static: utils_blob.cpp:521 match found at index 0
07-25 17:10:29.755 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x4100
07-25 17:10:29.755 8470 8471 D QSEECOMAPI: App is not loaded in QSEE
07-25 17:10:29.755 8470 8471 D QSEECOMAPI: app_arch = 2, total_files = 9
07-25 17:10:29.788 8470 8471 D QSEECOMAPI: Loaded image: APP id = 1179652
07-25 17:10:29.789 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xc00
07-25 17:10:29.789 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.793 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.793 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.798 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.798 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 1179652
07-25 17:10:29.798 8470 8471 I libsuntory_static: utils_blob.cpp:121 blob verisfication status: Blob OK
07-25 17:10:29.798 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2023
07-25 17:10:29.801 8470 8471 I libsuntory_static: utils_blob.cpp:497 found blob WIDEVINE
07-25 17:10:29.801 8470 8471 I libsuntory_static: utils_blob.cpp:521 match found at index 1
07-25 17:10:29.801 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x4100
07-25 17:10:29.801 8470 8471 D QSEECOMAPI: App is not loaded in QSEE
07-25 17:10:29.801 8470 8471 D QSEECOMAPI: app_arch = 2, total_files = 9
07-25 17:10:29.835 8470 8471 D QSEECOMAPI: Loaded image: APP id = 1245188
07-25 17:10:29.835 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xc00
07-25 17:10:29.835 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.838 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.838 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.843 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.843 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 1245188
07-25 17:10:29.844 8470 8471 I libsuntory_static: utils_blob.cpp:121 blob verisfication status: Blob OK
07-25 17:10:29.844 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2024
07-25 17:10:29.846 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 1
07-25 17:10:29.846 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2025
07-25 17:10:29.848 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.848 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2026
07-25 17:10:29.849 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.849 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2027
07-25 17:10:29.850 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.850 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2028
07-25 17:10:29.851 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.851 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2029
07-25 17:10:29.852 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.852 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2030
07-25 17:10:29.853 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.853 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2031
07-25 17:10:29.855 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.855 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2032
07-25 17:10:29.856 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.856 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2033
07-25 17:10:29.857 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.857 8470 8471 I libsuntory_static: utils_blob.cpp:462 process miscTA unit 2034
07-25 17:10:29.858 8470 8471 E libsuntory_static: utils_blob.cpp:477 invalid blob size 0
07-25 17:10:29.858 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
07-25 17:10:29.858 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 65537
07-25 17:10:29.862 8470 8471 E KeymasterUtils: TA API Major Version: 4
07-25 17:10:29.862 8470 8471 E KeymasterUtils: TA API Minor Version: 0
07-25 17:10:29.862 8470 8471 E KeymasterUtils: TA Major Version: 4
07-25 17:10:29.862 8470 8471 E KeymasterUtils: TA Minor Version: 162
07-25 17:10:29.866 622 628 D DrmLibTime: got the req here! ret=0
07-25 17:10:29.866 622 628 D DrmLibTime: command id, time_cmd_id = 770
07-25 17:10:29.866 622 628 D DrmLibTime: time_getutcsec starts!
07-25 17:10:29.866 622 628 D DrmLibTime: QSEE Time Listener: time_getutcsec
07-25 17:10:29.866 622 628 D DrmLibTime: QSEE Time Listener: get_utc_seconds
07-25 17:10:29.866 622 628 D DrmLibTime: QSEE Time Listener: time_get_modem_time
07-25 17:10:29.866 622 628 D DrmLibTime: QSEE Time Listener: Checking if ATS_MODEM is set or not.
07-25 17:10:29.866 622 628 D QC-time-services: Lib:time_genoff_operation: pargs->base = 13
07-25 17:10:29.866 622 628 D QC-time-services: Lib:time_genoff_operation: pargs->operation = 2
07-25 17:10:29.866 622 628 D QC-time-services: Lib:time_genoff_operation: pargs->ts_val = 0
07-25 17:10:29.866 622 628 D QC-time-services: Lib:time_genoff_operation: Send to server passed!!
07-25 17:10:29.866 792 800 D QC-time-services: Daemon: Connection accepted:time_genoff
07-25 17:10:29.867 792 8472 D QC-time-services: Daemon:Received base = 13, unit = 1, operation = 2,value = 0
07-25 17:10:29.867 792 8472 D QC-time-services: Daemon:genoff_opr: Base = 13, val = 0, operation = 2
07-25 17:10:29.867 792 8472 D QC-time-services: offset is: 1 for base: 13
07-25 17:10:29.867 622 628 E QC-time-services: Receive Passed == base = 13, unit = 1, operation = 2, result = 0
07-25 17:10:29.867 622 628 D DrmLibTime: QSEE Time Listener: ATS_MODEM is set. Try to retrieve it.
07-25 17:10:29.867 792 800 E QC-time-services: Daemon: Time-services: Waiting to acceptconnection
07-25 17:10:29.867 792 800 D QC-time-services: Daemon: Connection accepted:time_genoff
07-25 17:10:29.867 792 8473 D QC-time-services: Daemon:Received base = 13, unit = 1, operation = 1,value = 0
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:genoff_opr: Base = 13, val = 0, operation = 1
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon: genoff get for 13
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Value read from QTimer mseconds = 1307648
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Value read from RTC mseconds on boot = 48462179000
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Value read from QTimer mseconds = 1307648
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Value read from generic offset = 1547226365549
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Delta read on boot mseconds = 48462155118
07-25 17:10:29.868 792 8473 D QC-time-services: Daemon:Final Time = 1595689828315
07-25 17:10:29.868 622 628 D DrmLibTime: QSEE Time Listener: Time GenOff - seconds: 1595689828
07-25 17:10:29.868 622 628 D DrmLibTime: time_getutcsec returns 0, sec = 1595689828; nsec = 0
07-25 17:10:29.868 622 628 D DrmLibTime: time_getutcsec finished!
07-25 17:10:29.868 622 628 D DrmLibTime: iotcl_continue_command finished! and return 0
07-25 17:10:29.868 622 628 D DrmLibTime: before calling ioctl to read the next time_cmd
07-25 17:10:29.868 792 800 E QC-time-services: Daemon: Time-services: Waiting to acceptconnection
07-25 17:10:29.887 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x200
07-25 17:10:29.888 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.889 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.889 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.889 8470 8471 I libdevice_security_static: get_imei.cpp:180 imei STR munjeni edited, size 15
07-25 17:10:29.899 8470 8471 E KeyMasterHalDevice: Attest key send cmd failed
07-25 17:10:29.899 8470 8471 E KeyMasterHalDevice: ret: 0
07-25 17:10:29.899 8470 8471 E KeyMasterHalDevice: resp->status: -10003
07-25 17:10:29.906 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.906 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 65537
07-25 17:10:29.906 8470 8471 I [email protected]: key id ANDROID_ATTEST status PROVISIONED
07-25 17:10:29.907 587 587 I tad : MiscTA Unit 2021:
07-25 17:10:29.907 587 587 I tad : WRITTEN (Size 20)
07-25 17:10:29.930 587 587 I tad : Actual erase/write to flash done (count 4, time 1595689829).
07-25 17:10:29.930 587 587 I tad : MiscTA: Write of unit 2021 completed - OK
07-25 17:10:29.930 8470 8471 I [email protected]: suntory initialized
07-25 17:10:29.930 8470 8471 I [email protected]: wait for post_fs proprty
07-25 17:10:29.930 8470 8471 I [email protected]: post_fs property triggered
07-25 17:10:29.930 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x200
07-25 17:10:29.930 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.932 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.932 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.932 8470 8471 I libdevice_security_static: get_rooting_status.cpp:80 rooting_status 2
07-25 17:10:29.935 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x200
07-25 17:10:29.935 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.936 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.936 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.936 8470 8471 I libdevice_security_static: get_security_config.cpp:68 security configuration 1
07-25 17:10:29.936 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x83c0
07-25 17:10:29.936 8470 8471 D QSEECOMAPI: App is not loaded in QSEE
07-25 17:10:29.936 8470 8471 D QSEECOMAPI: app_arch = 2, total_files = 9
07-25 17:10:29.973 8470 8471 D QSEECOMAPI: Loaded image: APP id = 1310724
07-25 17:10:29.974 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xc00
07-25 17:10:29.974 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:29.977 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.977 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:29.980 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:29.980 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 1310724
07-25 17:10:29.982 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x83c0
07-25 17:10:29.982 8470 8471 D QSEECOMAPI: App is not loaded in QSEE
07-25 17:10:29.982 8470 8471 D QSEECOMAPI: app_arch = 2, total_files = 9
07-25 17:10:30.016 8470 8471 D QSEECOMAPI: Loaded image: APP id = 1376260
07-25 17:10:30.016 8470 8471 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xc00
07-25 17:10:30.016 8470 8471 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
07-25 17:10:30.020 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:30.020 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 131074
07-25 17:10:30.023 8470 8471 D QSEECOMAPI: QSEECom_dealloc_memory
07-25 17:10:30.023 8470 8471 D QSEECOMAPI: QSEECom_shutdown_app, app_id = 1376260
07-25 17:10:30.024 8470 8471 I [email protected]: credmgr initialized
07-25 17:10:30.025 8470 8471 I [email protected]: "vendor.keyprovd.suntory.prov" property set
07-25 17:10:33.798 853 853 I [email protected]: type=1400 audit(0.0:2107): avc: denied { search } for name="kgsl" dev="sysfs" ino=28936 scontext=u:r:hal_memtrack_default:s0 tcontext=u:object_r:sysfs_kgsl:s0 tclass=dir permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
07-25 17:10:36.689 8372 8372 W adbd : timeout expired while flushing socket, closing
Edit:
Now all ready https://forum.xda-developers.com/xp...m-fix-drm-fix-unlocked-bootloader-53-t4138269

Memory Injection: Call shared lib function inside remote process

Hello,
i'm currently able to call a function from a remote process by getting the PID, getting the base address in memory, copying the whole remote memory area into local memory area to find the function address by its signature and finally calling that function.
I've tested it successfully on my Samsung Galaxy S5 (32-bit + AOSP Bluetooth Stack), Sony Xperia X Compact (64-bit + AOSP Bluetooth Stack).
But on the OnePlus 7 Pro (64-bit + QTI Bluetooth Stack) the function returns 5.
I've set TRC_BTIF=5 in /system/etc/bluetooth/bt_stack.conf to see if the desired function is getting called because there should be a log output like:
Code:
06-25 21:19:33.024 1667 1667 D bt_btif : in, bd addr:, prop type:4, len:3
06-25 21:19:33.024 1667 1667 I bt_btif : btif_dm_get_adapter_property: type=0x4
Which isn't the case. So I assume the function is not getting called (correctly).
Here's the log output:
Code:
06-25 18:19:14.826 7409 7409 D bpp_qti : utils::getProcessId - Process found: com.android.bluetooth (pid: 7146)
06-25 18:19:14.828 7409 7409 D bpp_qti : injector::attach - Attached to process 7146
06-25 18:19:14.836 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9d4f0 with 6 arguments, return value is 7c786fe000
06-25 18:19:14.840 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9d4f0 with 6 arguments, return value is 7c786fd000
06-25 18:19:14.840 7409 7409 D bpp_qti : injector::write - Wrote 16 bytes to 0x7c786fd000 process 7146
06-25 18:19:14.845 7409 7409 D bpp_qti : utils::getRemoteFunctionAddress - Found remote function address: 7979928e3c
06-25 18:19:14.846 7146 7146 W bt_btif : bta_dm_act no entry for connected service cbs
06-25 18:19:14.846 7146 7146 E bt_btif : 00:00:00:00:00:00
06-25 18:19:14.847 7146 7177 D bt_btif : btif_hf_upstreams_evt: event=BTA_AG_CLOSE_EVT
06-25 18:19:14.847 7146 7177 E bt_btif : btif_hf_upstreams_evt: Invalid index 43613
06-25 18:19:14.847 7146 7146 E bt_btif : 00:00:00:00:00:00
06-25 18:19:14.847 7146 7146 D bt_btif : bta_ag_sco_event: index=0x0000, device=00:00:00:00:00:00, state=BTA_AG_SCO_SHUTDOWN_ST[0], event=BTA_AG_SCO_SHUTDOWN_E[6]
06-25 18:19:14.847 7146 7146 W bt_btif : bta_ag_sco_event: BTA_AG_SCO_SHUTDOWN_ST: Ignoring event BTA_AG_SCO_SHUTDOWN_E[6]
06-25 18:19:14.848 7146 7146 D bt_btif : BTA AG SCO State Change: [BTA_AG_SCO_SHUTDOWN_ST] -> [BTA_AG_SCO_SHUTDOWN_ST] after Event [BTA_AG_SCO_SHUTDOWN_E]
06-25 18:19:14.849 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7979928e3c with 1 arguments, return value is 5
06-25 18:19:14.853 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9cef0 with 2 arguments, return value is 0
06-25 18:19:14.856 7409 7409 D bpp_qti : injector::callRemoteFunction - Call remote function 7c76f9cef0 with 2 arguments, return value is 0
06-25 18:19:14.857 7409 7409 D bpp_qti : injector::detach - Detached from process 7146
And here's the full code: https://github.com/TeamJCD/BluetoothPlusPlus/tree/native/app/src/main/cpp
libbluetooth_qti.so of the OnePlus 7 Pro is attached as well as the pre-compiled bpp_qti for aarch64.
I've got the signature by running: gdb -batch -ex "disassemble/r btif_storage_get_adapter_property" libbluetooth_qti.so | column -ts $'\t' | awk '{for (i=1;i<=NF;i++) if ($i~/^[a-f0-9]{2}$/) printf("\\x%s",$i)} END{print ORS}'
The executable can be pushed directly to the device (`adb push bpp_qti /data/local/tmp/`) and running `/data/local/tmp/bpp_qti get` as root should return the Bluetooth Device Class.
Maybe someone here has an idea why this isn't working on QTI bt stack devices (the ones for which this cpp code was made because Qualcomm is missing essential code to get/set the device class through Java API).
We also tried calling `btif_dm_get_adapter_property` directly to see if this is working. But it wasn't.
I'm really out of ideas now.

Categories

Resources