[Android Software Development] PWn3R:
I'm having trouble getting a working TWRP for my device. I have a TWRP image using a prebuilt kernel that will load to the TWRP logo screen and it hangs there. If I format data before trying to boot TWRP, it works. The device in question is the Xiaomi Mi Mix 3. Below is a logcat from the device:

PS C:\Users\PWn3R\Downloads> adb logcat
--------- beginning of main
04-16 12:28:08.894 517 517 W auditd : type=2000 audit(0.0:1): initialized
04-16 12:28:09.839 517 517 I auditd : type=1403 audit(0.0:2): policy loaded auid=4294967295 ses=4294967295
04-16 12:28:09.849 1 1 I init : type=1400 audit(0.0:3): avc: denied { setcheckreqprot } for scontext=u:r:init:s0 tcontext=u:object_r:kernel:s0 tclass=security permissive=1
04-16 12:28:09.849 1 1 I init : type=1400 audit(0.0:4): avc: denied { create } for name="cgroup.procs" scontext=u:r:init:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
04-16 12:28:09.849 1 1 I init : type=1400 audit(0.0:5): avc: denied { write } for path="/acct/uid_0/pid_505/cgroup.procs" dev="rootfs" ino=15749 scontext=u:r:init:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
04-16 12:28:10.109 1 1 I init : type=1400 audit(0.0:6): avc: denied { create } for name="bin" scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1
04-16 12:28:10.109 1 1 I init : type=1400 audit(0.0:7): avc: denied { create } for name="sh" scontext=u:r:init:s0 tcontext=u:object_r:shell_exec:s0 tclass=lnk_file permissive=1
04-16 12:28:10.109 1 1 I init : type=1400 audit(0.0:8): avc: denied { create } for name="manifest.xml" scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 tclass=lnk_file permissive=1
04-16 12:28:10.109 1 1 I init : type=1400 audit(0.0:9): avc: denied { module_request } for kmod="fs-functionfs" scontext=u:r:init:s0 tcontext=u:r:kernel:s0 tclass=system permissive=1
04-16 12:28:10.119 518 518 I init : type=1400 audit(0.0:10): avc: denied { entrypoint } for path="/sbin/logd" dev="rootfs" ino=1397 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:17): avc: denied { read } for name="plat_hwservice_contexts" dev="rootfs" ino=3812 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:18): avc: denied { open } for path="/vendor_hwservice_contexts" dev="rootfs" ino=3900 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:19): avc: denied { getattr } for path="/vendor_hwservice_contexts" dev="rootfs" ino=3900 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:20): avc: denied { create } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=netlink_selinux_socket permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:21): avc: denied { bind } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=netlink_selinux_socket permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:22): avc: denied { read } for name="perms" dev="selinuxfs" ino=67112181 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir permissive=1
04-16 12:28:10.129 515 515 I hwservicemanage: type=1400 audit(0.0:23): avc: denied { open } for path="/sys/fs/selinux/class/hwservice_manager/perms" dev="selinuxfs" ino=67112181 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir permissive=1
04-16 12:28:10.139 515 515 I hwservicemanage: type=1400 audit(0.0:24): avc: denied { write } for name="access" dev="selinuxfs" ino=6 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1
04-16 12:28:10.139 515 515 I hwservicemanage: type=1400 audit(0.0:25): avc: denied { compute_av } for scontext=u:r:recovery:s0 tcontext=u:object_r:kernel:s0 tclass=security permissive=1
04-16 12:28:10.145 515 515 E SELinux : avc: denied { add } for interface=android.hidl.manager::IServiceManager pid=515 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_manager_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.145 515 515 E SELinux : avc: denied { add } for interface=android.hidl.base::IBase pid=515 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_base_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.145 515 515 E SELinux : avc: denied { add } for interface=android.hidl.token::ITokenManager pid=515 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_token_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.147 515 515 I hwservicemanager: hwservicemanager is ready now.
04-16 12:28:10.167 540 540 D QSEECOMD: : qseecom listener services process entry PPID = 1
04-16 12:28:10.167 540 540 E QSEECOMD: : Listener: index = 0, hierarchy = 0
04-16 12:28:10.167 540 540 D QSEECOMD: : Init dlopen(librpmb.so, RTLD_NOW) succeeds
04-16 12:28:10.167 540 540 D QSEECOMD: : Init::Init dlsym(g_FSHandle rpmb_init_service) succeeds
04-16 12:28:10.170 540 540 I rpmb_ufs: RPMB Mult (512-byte sector) = 32768, Rel_sec_cnt = 64
04-16 12:28:10.170 540 540 E DrmLibRpmb: rpmb_init succeeded! with ret = 0
04-16 12:28:10.170 540 540 D QSEECOMD: : Init rpmb_init_service ret = 0
04-16 12:28:10.170 540 540 D QSEECOMD: : RPMB system services: init (Listener ID = 8192)
04-16 12:28:10.170 540 540 E QSEECOMD: : Listener: index = 1, hierarchy = 0
04-16 12:28:10.171 540 540 D QSEECOMD: : Init dlopen(libssd.so, RTLD_NOW) succeeds
04-16 12:28:10.171 540 540 D QSEECOMD: : Init::Init dlsym(g_FSHandle ssd_init_service) succeeds
04-16 12:28:10.171 540 540 E SSD : ssd_init_service succeeded!
04-16 12:28:10.171 540 540 D QSEECOMD: : Init ssd_init_service ret = 0
04-16 12:28:10.171 540 540 D QSEECOMD: : SSD system services: init (Listener ID = 12288)
04-16 12:28:10.171 540 540 E QSEECOMD: : Listener: index = 2, hierarchy = 0
04-16 12:28:10.189 540 540 D QSEECOMD: : Init dlopen(libsecureui.so, RTLD_NOW) succeeds
04-16 12:28:10.189 540 540 D QSEECOMD: : Init::Init dlsym(g_FSHandle secure_ui_init) succeeds
04-16 12:28:10.189 540 540 D QSEECOMD: : Init secure_ui_init ret = 0
04-16 12:28:10.189 540 540 D QSEECOMD: : secure UI services: init (Listener ID = 16384)
04-16 12:28:10.190 540 540 D QSEECOMD: : Parent qseecom daemon process paused!!
04-16 12:28:10.190 544 544 D QSEECOMD: : qseecom listener service threads starting!!!
04-16 12:28:10.190 544 544 D QSEECOMD: : Total listener services to start = 9
04-16 12:28:10.190 544 544 E QSEECOMD: : Listener: index = 0, hierarchy = 1
04-16 12:28:10.190 544 544 D QSEECOMD: : Init dlopen(librpmb.so, RTLD_NOW) succeeds
04-16 12:28:10.190 544 544 D QSEECOMD: : Init::Init dlsym(g_FSHandle rpmb_start) succeeds
04-16 12:28:10.190 544 544 D QSEECOMAPI: QSEECom_register_listener 8192 sb_length = 0x6400
04-16 12:28:10.191 544 544 D QSEECOMD: : Init rpmb_start ret = 0
04-16 12:28:10.191 544 544 D QSEECOMD: : RPMB system services: Started (Listener ID = 8192)
04-16 12:28:10.191 544 544 E QSEECOMD: : Listener: index = 1, hierarchy = 1
04-16 12:28:10.191 544 544 D QSEECOMD: : Init dlopen(libssd.so, RTLD_NOW) succeeds
04-16 12:28:10.191 544 544 D QSEECOMD: : Init::Init dlsym(g_FSHandle ssd_start) succeeds
04-16 12:28:10.195 544 544 E QSEECOMD: : Listener: index = 6, hierarchy = 1
04-16 12:28:10.195 544 544 D QSEECOMD: : Init dlopen(libqisl.so, RTLD_NOW) succeeds
04-16 12:28:10.196 544 544 D QSEECOMD: : Init::Init dlsym(g_FSHandle qisl_start) succeeds
--------- beginning of system
04-16 12:28:10.196 544 551 I QISL : QSEE Interrupt Service Listener Thread is started
04-16 12:28:10.196 544 551 D QSEECOMAPI: QSEECom_register_listener 36864 sb_length = 0x1f4
04-16 12:28:10.196 544 551 I QISL : QSEE Interrupt Service Listener was activated successfully
04-16 12:28:10.196 544 544 D QSEECOMD: : Init qisl_start ret = 0
04-16 12:28:10.196 544 544 D QSEECOMD: : interrupt services: Started (Listener ID = 36864)
04-16 12:28:10.196 544 544 E QSEECOMD: : Listener: index = 7, hierarchy = 1
04-16 12:28:10.196 544 544 D QSEECOMD: : Init dlopen(libspl.so, RTLD_NOW) succeeds
04-16 12:28:10.196 544 544 D QSEECOMD: : Init::Init dlsym(g_FSHandle spl_start) succeeds
04-16 12:28:10.196 544 544 D SPL : Call QSEECom_register_listener()
04-16 12:28:10.196 544 544 D QSEECOMAPI: QSEECom_register_listener 45056 sb_length = 0x400
04-16 12:28:10.196 544 544 D SPL : Registered listener sucessfully!
04-16 12:28:10.196 544 544 D SPL : pipe read-fd [31] write-fd [32]
04-16 12:28:10.196 544 544 D SPL : Create thread
04-16 12:28:10.197 544 544 D SPL : Thread created sucessfully.
04-16 12:28:10.197 544 544 D QSEECOMD: : Init spl_start ret = 0
04-16 12:28:10.197 544 552 D SPL : spl_dispatch() started
04-16 12:28:10.200 544 544 D QSEECOMD: : QSEECOM DAEMON RUNNING
04-16 12:28:10.200 520 520 I ArmToArm64Assembler: generated scanline__00000077:03010101_00008001_00000000 [195 ipp] (241 ins) at [0x75bfd003c0:0x75bfd00784] in 50886 ns
04-16 12:28:10.211 556 556 I SELinux : SELinux: Loaded service_contexts from:
04-16 12:28:10.211 556 556 I SELinux : /plat_service_contexts
04-16 12:28:10.211 556 556 I SELinux : /vendor_service_contexts
04-16 12:28:10.211 555 555 E cutils-trace: Error opening trace file: No such file or directory (2)
04-16 12:28:10.211 515 515 E cutils-trace: Error opening trace file: No such file or directory (2)
04-16 12:28:10.212 515 515 E SELinux : avc: denied { find } for interface=android.hardware.gatekeeper::IGatekeeper pid=555 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_gatekeeper_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.216 554 554 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
04-16 12:28:10.217 554 554 D QSEECOMAPI: App is already loaded QSEE and app id = 1
04-16 12:28:10.218 554 554 E KeymasterUtils: TA API Major Version: 4
04-16 12:28:10.218 554 554 E KeymasterUtils: TA API Minor Version: 0
04-16 12:28:10.218 554 554 E KeymasterUtils: TA Major Version: 4
04-16 12:28:10.218 554 554 E KeymasterUtils: TA Minor Version: 152
04-16 12:28:10.221 554 554 I ServiceManagement: Removing namespace from process name android.hardware.keymaster@4.0-service-qti to keymaster@4.0-service-qti.
04-16 12:28:10.222 554 554 E cutils-trace: Error opening trace file: No such file or directory (2)
04-16 12:28:10.222 520 520 I ArmToArm64Assembler: generated scanline__00000077:03545401_00000A01_00000000 [ 69 ipp] (113 ins) at [0x75bfd00790:0x75bfd00954] in 45260 ns
04-16 12:28:10.227 520 520 I ArmToArm64Assembler: generated scanline__00000077:03545401_00000A08_00000000 [ 69 ipp] (116 ins) at [0x75bfd00960:0x75bfd00b30] in 31719 ns
04-16 12:28:10.234 555 555 D vndksupport: Loading /vendor/lib64/hw/android.hardware.gatekeeper@1.0-impl-qti.so from current namespace instead of sphal namespace.
04-16 12:28:10.234 515 515 E SELinux : avc: denied { add } for interface=android.hardware.keymaster::IKeymasterDevice pid=554 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_keymaster_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.237 555 555 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
04-16 12:28:10.238 555 555 D QSEECOMAPI: App is already loaded QSEE and app id = 1
04-16 12:28:10.240 555 555 E KeymasterUtils: TA API Major Version: 4
04-16 12:28:10.240 555 555 E KeymasterUtils: TA API Minor Version: 0
04-16 12:28:10.240 555 555 E KeymasterUtils: TA Major Version: 4
04-16 12:28:10.240 555 555 E KeymasterUtils: TA Minor Version: 152
04-16 12:28:10.242 555 555 I ServiceManagement: Removing namespace from process name android.hardware.gatekeeper@1.0-service-qti to gatekeeper@1.0-service-qti.
04-16 12:28:10.242 515 515 E SELinux : avc: denied { add } for interface=android.hardware.gatekeeper::IGatekeeper pid=555 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_gatekeeper_hwservice:s0 tclass=hwservice_manager permissive=1
04-16 12:28:10.242 555 555 I android.hardware.gatekeeper@1.0-service: Registration complete for android.hardware.gatekeeper@1.0::IGatekeeper/default.
02-23 06:52:24.425 520 520 E cutils-trace: Error opening trace file: No such file or directory (2)
02-23 06:52:24.445 515 515 W hwservicemanager: getTransport: Cannot find entry android.hidl.manager@1.0::IServiceManager/default in either framework or device manifest.
02-23 06:52:24.446 515 515 E SELinux : avc: denied { find } for interface=android.hardware.keymaster::IKeymasterDevice pid=520 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_keymaster_hwservice:s0 tclass=hwservice_manager permissive=1
02-23 06:52:24.448 520 520 I ServiceManagement: getService: Trying again for android.hardware.keymaster@3.0::IKeymasterDevice/default...
02-23 06:52:25.448 520 520 W ServiceManagement: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
02-23 06:52:27.449 520 520 I chatty : uid=0(root) /sbin/recovery identical 2 lines
02-23 06:52:28.449 520 520 W ServiceManagement: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
02-23 06:52:29.250 579 580 I adbd : initializing functionfs
02-23 06:52:29.250 579 580 I adbd : opening control endpoint /dev/usb-ffs/adb/ep0
02-23 06:52:29.251 579 580 I adbd : functionfs successfully initialized
02-23 06:52:29.251 579 580 I adbd : registering usb transport
02-23 06:52:29.251 579 581 E cutils-trace: Error opening trace file: No such file or directory (2)
02-23 06:52:29.449 520 520 W ServiceManagement: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...

We have a working TWRP image that was compiled by someone from "LR Team" in China, but there are some issues that I'd like to resolve. The source, including device tree have never been posted by that author that I can find. I can post a copy of the device tree I am using, but it is almost identical to the Mi Mix 2s one that [MENTION=9159243]notsyncing[/MENTION] made. I just added device model edits, an appropriate kernel and some settings I found by booting the chinese TWRP image we have. I highly suspect the decryption is hanging for user data causing this issue.

Edit: I made about 30 more builds today, and tried numerous things. I think this device needs to have keymaster4, and the chinese one doesn't even have keymaster3, but no matter *WHAT* I do in my tree, the image I make is *ALWAYS* trying to start keymaster3, and failing. I can get it to try without exploding, but it never actually works.