[Xiaomi Mi 8 Pro Guides, News, & Discussion] PCrazee:
Yes.

Step 1: flash stock ROM, Version 10.2.2.0. Device is unlocked.

Step 2:

# adb devices
List of devices attached
8f202793	device
# adb reboot bootloader
# fastboot devices
8f202793	fastboot
# fastboot flash recovery equuleus-331-607.img
Sending 'recovery' (60424 KB) OKAY [ 1.864s]
Writing 'recovery' OKAY [ 0.283s]
Finished. Total time: 2.152s
# fastboot boot equuleus-331-607.img
Sending 'boot.img' (60424 KB) OKAY [ 1.834s]
Booting OKAY [ 0.088s]
Finished. Total time: 1.957s
# adb push AOSiP-9.0-GSI-arm64_ab-20190819.img /sdcard
AOSiP-9.0-GSI-arm64_ab-20190819.img: 1 file pushed, 0 skipped. 22.4 MB/s (1508065560 bytes in 64.182s)

In TWRP:

Wipe > Factory Reset

Wipe > Advanced Wipe > [x] System

Install > Select the AOSiP img > System Image > Swipe to Flash

Reboot

Endless Splash Screen Cycles :(

Vol Up + Power: TWRP Start Screen, but no menu

# adb logcat

01-04 07:38:32.507 574 574 W auditd : type=2000 audit(0.0:1): initialized
01-04 07:38:33.529 574 574 I auditd : type=1403 audit(0.0:2): policy loaded auid=4294967295 ses=4294967295
01-04 07:38:33.539 1 1 I init : type=1400 audit(0.0:3): avc: denied { setcheckreqprot } for scontext=u:r:init:s0 tcontext=u:object_r:kernel:s0 tclass=security permissive=1
01-04 07:38:33.539 1 1 I init : type=1400 audit(0.0:4): avc: denied { create } for name="cgroup.procs" scontext=u:r:init:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
01-04 07:38:33.539 1 1 I init : type=1400 audit(0.0:5): avc: denied { write } for path="/acct/uid_0/pid_514/cgroup.procs" dev="rootfs" ino=17677 scontext=u:r:init:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
01-04 07:38:33.559 519 519 I init.fingerprin: type=1400 audit(0.0:6): avc: denied { write } for name="/" dev="tmpfs" ino=17565 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir permissive=1
01-04 07:38:33.559 519 519 I init.fingerprin: type=1400 audit(0.0:7): avc: denied { add_name } for name="null" scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir permissive=1
01-04 07:38:33.559 519 519 I init.fingerprin: type=1400 audit(0.0:8): avc: denied { create } for name="null" scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=file permissive=1
01-04 07:38:33.559 519 519 I init.fingerprin: type=1400 audit(0.0:9): avc: denied { write open } for path="/dev/null" dev="tmpfs" ino=24498 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=file permissive=1
01-04 07:38:33.829 528 528 I ueventd : type=1400 audit(0.0:10): avc: denied { relabelfrom } for name="null" dev="tmpfs" ino=24498 scontext=u:r:ueventd:s0 tcontext=u:object_r:device:s0 tclass=file permissive=1
01-04 07:38:34.864 577 578 I adbd : initializing functionfs
01-04 07:38:34.864 577 578 I adbd : opening control endpoint /dev/usb-ffs/adb/ep0
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:43): avc: denied { read } for name="nonplat_hwservice_contexts" dev="rootfs" ino=13763 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:44): avc: denied { open } for path="/nonplat_hwservice_contexts" dev="rootfs" ino=13763 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:45): avc: denied { getattr } for path="/nonplat_hwservice_contexts" dev="rootfs" ino=13763 scontext=u:r:recovery:s0 tcontext=u:object_r:hwservice_contexts_file:s0 tclass=file permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:46): avc: denied { create } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=netlink_selinux_socket permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:47): avc: denied { bind } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=netlink_selinux_socket permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:48): avc: denied { read } for name="perms" dev="selinuxfs" ino=67112146 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:49): avc: denied { open } for path="/sys/fs/selinux/class/hwservice_manager/perms" dev="selinuxfs" ino=67112146 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:50): avc: denied { write } for name="access" dev="selinuxfs" ino=6 scontext=u:r:recovery:s0 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1
01-04 07:38:34.869 572 572 I hwservicemanage: type=1400 audit(0.0:51): avc: denied { compute_av } for scontext=u:r:recovery:s0 tcontext=u:object_r:kernel:s0 tclass=security permissive=1
01-04 07:38:34.869 573 573 I SELinux : SELinux: Loaded service_contexts from:
01-04 07:38:34.869 573 573 I SELinux : /plat_service_contexts
01-04 07:38:34.869 573 573 I SELinux : /nonplat_service_contexts
01-04 07:38:34.882 572 572 E SELinux : avc: denied { add } for interface=android.hidl.manager::IServiceManager pid=572 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_manager_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:34.883 572 572 E SELinux : avc: denied { add } for interface=android.hidl.base::IBase pid=572 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_base_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:34.883 572 572 E SELinux : avc: denied { add } for interface=android.hidl.token::ITokenManager pid=572 scontext=u:r:recovery:s0 tcontext=u:object_r:hidl_token_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:34.883 572 572 E hwservicemanager: BINDER_SET_INHERIT_FIFO_PRIO failed with error -1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:52): avc: denied { getattr } for path="/dev/null" dev="tmpfs" ino=24498 scontext=u:r:recovery:s0 tcontext=u:object_r:null_device:s0 tclass=file permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:53): avc: denied { search } for name="backlight" dev="sysfs" ino=48252 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=dir permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:54): avc: denied { read } for name="panel0-backlight" dev="sysfs" ino=48253 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=dir permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:55): avc: denied { open } for path="/sys/devices/platform/soc/ae00000.qcom,mdss_mdp/backlight/panel0-backlight" dev="sysfs" ino=48253 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=dir permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:56): avc: denied { getattr } for path="/sys/devices/platform/soc/ae00000.qcom,mdss_mdp/backlight/panel0-backlight/max_brightness" dev="sysfs" ino=48261 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=file permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:57): avc: denied { read } for name="max_brightness" dev="sysfs" ino=48261 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=file permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:58): avc: denied { open } for path="/sys/devices/platform/soc/ae00000.qcom,mdss_mdp/backlight/panel0-backlight/max_brightness" dev="sysfs" ino=48261 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=file permissive=1
01-04 07:38:34.919 576 576 I recovery: type=1400 audit(0.0:59): avc: denied { write } for name="brightness" dev="sysfs" ino=48259 scontext=u:r:recovery:s0 tcontext=u:object_r:sysfs_graphics:s0 tclass=file permissive=1
01-04 07:38:35.139 1 1 I init : type=1400 audit(0.0:60): avc: denied { write } for name="android0" dev="sysfs" ino=68060 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_android_usb:s0 tclass=dir permissive=1
01-04 07:38:35.139 1 1 I init : type=1400 audit(0.0:61): avc: denied { add_name } for name="enable" scontext=u:r:init:s0 tcontext=u:object_r:sysfs_android_usb:s0 tclass=dir permissive=1
01-04 07:38:35.139 1 1 I init : type=1400 audit(0.0:62): avc: denied { create } for name="enable" scontext=u:r:init:s0 tcontext=u:object_r:sysfs_android_usb:s0 tclass=file permissive=1
01-04 07:38:35.169 592 592 I adbd : type=1400 audit(0.0:63): avc: denied { read write } for path="/dev/null" dev="tmpfs" ino=24498 scontext=u:r:adbd:s0 tcontext=u:object_r:null_device:s0 tclass=file permissive=1
01-04 07:38:35.169 592 592 I adbd : type=1400 audit(0.0:64): avc: denied { open } for path="/dev/null" dev="tmpfs" ino=24498 scontext=u:r:adbd:s0 tcontext=u:object_r:null_device:s0 tclass=file permissive=1
01-04 07:38:35.190 592 593 I adbd : initializing functionfs
01-04 07:38:35.190 592 593 I adbd : opening control endpoint /dev/usb-ffs/adb/ep0
01-04 07:38:35.199 591 591 I qseecomd: type=1400 audit(0.0:65): avc: denied { setattr } for name="sg2" dev="tmpfs" ino=24529 scontext=u:r:recovery:s0 tcontext=u:object_r:sg_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.208 591 591 D QSEECOMD: : qseecom listener services process entry PPID = 1
01-04 07:38:35.208 591 591 E QSEECOMD: : Listener: index = 0, hierarchy = 0
01-04 07:38:35.209 591 591 D QSEECOMD: : Init dlopen(librpmb.so, RTLD_NOW) succeeds
01-04 07:38:35.209 591 591 D QSEECOMD: : Init::Init dlsym(g_FSHandle rpmb_init_service) succeeds
01-04 07:38:35.211 591 591 I rpmb_ufs: RPMB Mult (512-byte sector) = 32768, Rel_sec_cnt = 64
01-04 07:38:35.211 591 591 E DrmLibRpmb: rpmb_init succeeded! with ret = 0
01-04 07:38:35.211 591 591 D QSEECOMD: : Init rpmb_init_service ret = 0
01-04 07:38:35.211 591 591 D QSEECOMD: : RPMB system services: init (Listener ID = 8192)
01-04 07:38:35.212 591 591 E QSEECOMD: : Listener: index = 1, hierarchy = 0
01-04 07:38:35.212 591 591 D QSEECOMD: : Init dlopen(libssd.so, RTLD_NOW) succeeds
01-04 07:38:35.212 591 591 D QSEECOMD: : Init::Init dlsym(g_FSHandle ssd_init_service) succeeds
01-04 07:38:35.212 591 591 E SSD : ssd_init_service succeeded!
01-04 07:38:35.212 591 591 D QSEECOMD: : Init ssd_init_service ret = 0
01-04 07:38:35.212 591 591 D QSEECOMD: : SSD system services: init (Listener ID = 12288)
01-04 07:38:35.212 591 591 E QSEECOMD: : Listener: index = 2, hierarchy = 0
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:66): avc: denied { read } for name="ion" dev="tmpfs" ino=15862 scontext=u:r:recovery:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:67): avc: denied { open } for path="/dev/ion" dev="tmpfs" ino=15862 scontext=u:r:recovery:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:68): avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15862 ioctlcmd=0x4900 scontext=u:r:recovery:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:69): avc: denied { read write } for name="vndbinder" dev="tmpfs" ino=1394 scontext=u:r:recovery:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:70): avc: denied { open } for path="/dev/vndbinder" dev="tmpfs" ino=1394 scontext=u:r:recovery:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.219 595 595 I qseecomd: type=1400 audit(0.0:71): avc: denied { ioctl } for path="/dev/vndbinder" dev="tmpfs" ino=1394 ioctlcmd=0x6209 scontext=u:r:recovery:s0 tcontext=u:object_r:vndbinder_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.228 591 591 D QSEECOMD: : Init dlopen(libsecureui.so, RTLD_NOW) succeeds
01-04 07:38:35.228 591 591 D QSEECOMD: : Init::Init dlsym(g_FSHandle secure_ui_init) succeeds
01-04 07:38:35.228 591 591 D QSEECOMD: : Init secure_ui_init ret = 0
01-04 07:38:35.228 591 591 D QSEECOMD: : secure UI services: init (Listener ID = 16384)
01-04 07:38:35.229 591 591 D QSEECOMD: : Parent qseecom daemon process paused!!
01-04 07:38:35.229 595 595 D QSEECOMD: : qseecom listener service threads starting!!!
01-04 07:38:35.229 595 595 D QSEECOMD: : Total listener services to start = 9
01-04 07:38:35.229 595 595 E QSEECOMD: : Listener: index = 0, hierarchy = 1
01-04 07:38:35.230 595 595 D QSEECOMD: : Init dlopen(librpmb.so, RTLD_NOW) succeeds
01-04 07:38:35.230 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle rpmb_start) succeeds
01-04 07:38:35.230 595 595 D QSEECOMAPI: QSEECom_register_listener 8192 sb_length = 0x6400
01-04 07:38:35.230 595 595 D QSEECOMD: : Init rpmb_start ret = 0
01-04 07:38:35.230 595 595 D QSEECOMD: : RPMB system services: Started (Listener ID = 8192)
01-04 07:38:35.230 595 595 E QSEECOMD: : Listener: index = 1, hierarchy = 1
01-04 07:38:35.230 595 595 D QSEECOMD: : Init dlopen(libssd.so, RTLD_NOW) succeeds
01-04 07:38:35.230 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle ssd_start) succeeds
01-04 07:38:35.230 595 595 D QSEECOMAPI: QSEECom_register_listener 12288 sb_length = 0x5000
01-04 07:38:35.231 595 595 D QSEECOMD: : Init ssd_start ret = 0
01-04 07:38:35.231 595 595 D QSEECOMD: : SSD system services: Started (Listener ID = 12288)
01-04 07:38:35.231 595 595 E QSEECOMD: : Listener: index = 2, hierarchy = 1
01-04 07:38:35.231 595 595 D QSEECOMD: : Init dlopen(libsecureui.so, RTLD_NOW) succeeds
01-04 07:38:35.231 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle secure_ui_start) succeeds
01-04 07:38:35.231 595 595 D QSEECOMAPI: QSEECom_register_listener 16384 sb_length = 0x10a8
01-04 07:38:35.231 595 595 D QSEECOMD: : Init secure_ui_start ret = 0
01-04 07:38:35.231 595 595 D QSEECOMD: : secure UI services: Started (Listener ID = 16384)
01-04 07:38:35.231 595 595 E QSEECOMD: : Listener: index = 3, hierarchy = 1
01-04 07:38:35.232 595 595 D QSEECOMD: : Init dlopen(libdrmtime.so, RTLD_NOW) succeeds
01-04 07:38:35.232 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle atime_start) succeeds
01-04 07:38:35.232 595 595 D DrmLibTime: QSEE Time Listener: atime_start
01-04 07:38:35.232 595 595 D QSEECOMAPI: QSEECom_register_listener 11 sb_length = 0x5000
01-04 07:38:35.232 595 595 D DrmLibTime: registering fs service to QSEECom is done!
01-04 07:38:35.232 595 595 D DrmLibTime: begin to create a thread!
01-04 07:38:35.232 595 595 D DrmLibTime: Creating a pthread in atime_start is done! return 0
01-04 07:38:35.232 595 595 D QSEECOMD: : Init atime_start ret = 0
01-04 07:38:35.232 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle fs_start) succeeds
01-04 07:38:35.232 595 595 D QSEECOMAPI: QSEECom_register_listener 10 sb_length = 0x5000
01-04 07:38:35.233 595 595 D QSEECOMD: : Init fs_start ret = 0
01-04 07:38:35.233 595 595 D QSEECOMD: : file system services: Started (Listener ID = 10)
01-04 07:38:35.233 595 595 E QSEECOMD: : Listener: index = 5, hierarchy = 1
01-04 07:38:35.233 595 595 D QSEECOMD: : Init dlopen(libdrmfs.so, RTLD_NOW) succeeds
01-04 07:38:35.233 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle gpfs_start) succeeds
01-04 07:38:35.233 595 595 E DrmLibFs: Error: Invalid config file
01-04 07:38:35.233 595 595 E DrmLibFs: Data path not parsed: Using default data path: /data/vendor/tzstorage/
01-04 07:38:35.233 595 595 E DrmLibFs: Persist path not parsed: Using default persist path: /persist/data/
01-04 07:38:35.233 595 595 D QSEECOMAPI: QSEECom_register_listener 28672 sb_length = 0x7e000
01-04 07:38:35.234 595 595 D QSEECOMD: : Init gpfs_start ret = 0
01-04 07:38:35.234 595 595 D QSEECOMD: : gpfile system services: Started (Listener ID = 28672)
01-04 07:38:35.234 595 595 E QSEECOMD: : Listener: index = 6, hierarchy = 1
01-04 07:38:35.234 595 595 D QSEECOMD: : Init dlopen(libqisl.so, RTLD_NOW) succeeds
01-04 07:38:35.234 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle qisl_start) succeeds
--------- beginning of system
01-04 07:38:35.234 595 602 I QISL : QSEE Interrupt Service Listener Thread is started
01-04 07:38:35.234 595 602 D QSEECOMAPI: QSEECom_register_listener 36864 sb_length = 0x1f4
01-04 07:38:35.235 595 602 I QISL : QSEE Interrupt Service Listener was activated successfully
01-04 07:38:35.235 595 595 D QSEECOMD: : Init qisl_start ret = 0
01-04 07:38:35.235 595 595 D QSEECOMD: : interrupt services: Started (Listener ID = 36864)
01-04 07:38:35.235 595 595 E QSEECOMD: : Listener: index = 7, hierarchy = 1
01-04 07:38:35.235 595 595 D QSEECOMD: : Init dlopen(libspl.so, RTLD_NOW) succeeds
01-04 07:38:35.235 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle spl_start) succeeds
01-04 07:38:35.235 595 595 D SPL : Call QSEECom_register_listener()
01-04 07:38:35.235 595 595 D QSEECOMAPI: QSEECom_register_listener 45056 sb_length = 0x400
01-04 07:38:35.235 595 595 D SPL : Registered listener sucessfully!
01-04 07:38:35.235 595 595 D SPL : pipe read-fd [31] write-fd [32]
01-04 07:38:35.235 595 595 D SPL : Create thread
01-04 07:38:35.235 595 595 D SPL : Thread created sucessfully.
01-04 07:38:35.235 595 595 D QSEECOMD: : Init spl_start ret = 0
01-04 07:38:35.236 595 595 D QSEECOMD: : Init dlopen(libGPreqcancel.so, RTLD_NOW) succeeds
01-04 07:38:35.236 595 595 D QSEECOMD: : Init::Init dlsym(g_FSHandle gp_reqcancel_start) succeeds
01-04 07:38:35.236 595 595 D QSEECOMAPI: QSEECom_register_listener 4352 sb_length = 0x5000
01-04 07:38:35.236 595 595 D QSEECOMD: : Init gp_reqcancel_start ret = 0
01-04 07:38:35.236 595 595 D QSEECOMD: : gp request cancellation services: Started (Listener ID = 4352)
01-04 07:38:35.239 606 606 I android.hardwar: type=1400 audit(0.0:73): avc: denied { call } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=binder permissive=1
01-04 07:38:35.239 605 605 I android.hardwar: type=1400 audit(0.0:72): avc: denied { call } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=binder permissive=1
01-04 07:38:35.239 576 576 I recovery: type=1400 audit(0.0:74): avc: denied { execmem } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=process permissive=1
01-04 07:38:35.239 576 576 I recovery: type=1400 audit(0.0:75): avc: denied { execute } for path="/dev/ashmem" dev="tmpfs" ino=15798 scontext=u:r:recovery:s0 tcontext=u:object_r:ashmem_device:s0 tclass=chr_file permissive=1
01-04 07:38:35.239 595 595 D QSEECOMD: : QSEECOM DAEMON RUNNING
01-04 07:38:35.254 606 606 E cutils-trace: Error opening trace file: No such file or directory (2)
01-04 07:38:35.254 605 605 E cutils-trace: Error opening trace file: No such file or directory (2)
01-04 07:38:35.255 572 572 E cutils-trace: Error opening trace file: No such file or directory (2)
01-04 07:38:35.255 572 572 E SELinux : avc: denied { find } for interface=android.hardware.keymaster::IKeymasterDevice pid=605 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_keymaster_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:35.255 572 572 W /sbin/hwservicemanager: Cannot open /system/manifest.xml
01-04 07:38:35.256 576 576 I ArmToArm64Assembler: generated scanline__00000077:03010101_00008001_00000000 [195 ipp] (241 ins) at [0x7d5f4583c0:0x7d5f458784] in 76094 ns
01-04 07:38:35.259 572 572 E SELinux : avc: denied { find } for interface=android.hardware.gatekeeper::IGatekeeper pid=606 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_gatekeeper_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:35.259 572 572 W /sbin/hwservicemanager: Cannot open /system/manifest.xml
01-04 07:38:35.259 605 605 D vndksupport: Loading /usr/lib64/hw/android.hardware.keymaster@3.0-impl-qti.so from current namespace instead of sphal namespace.
01-04 07:38:35.262 605 605 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
01-04 07:38:35.262 605 605 D QSEECOMAPI: App is already loaded QSEE and app id = 1
01-04 07:38:35.264 606 606 D vndksupport: Loading /usr/lib64/hw/android.hardware.gatekeeper@1.0-impl-qti.so from current namespace instead of sphal namespace.
01-04 07:38:35.266 605 605 E KeymasterUtils: TA API Major Verion: 3
01-04 07:38:35.266 605 605 E KeymasterUtils: TA API Minor Verion: 0
01-04 07:38:35.266 605 605 E KeymasterUtils: TA Major Verion: 3
01-04 07:38:35.269 606 606 I gatekeeper@1.0-: type=1400 audit(0.0:76): avc: denied { transfer } for scontext=u:r:recovery:s0 tcontext=u:r:recovery:s0 tclass=binder permissive=1
01-04 07:38:35.269 606 606 D QSEECOMAPI: App is already loaded QSEE and app id = 1
01-04 07:38:35.271 605 607 I spcomlib: [wait_skp_ready] Start wait for SKP ready.
01-04 07:38:35.274 606 606 E KeymasterUtils: TA API Major Verion: 3
01-04 07:38:35.274 606 606 E KeymasterUtils: TA API Minor Verion: 0
01-04 07:38:35.274 606 606 E KeymasterUtils: TA Major Verion: 3
01-04 07:38:35.274 606 606 E KeymasterUtils: TA Minor Verion: 130
01-04 07:38:35.275 605 605 E KeyMasterHalDevice: configure
01-04 07:38:35.275 605 605 E KeyMasterHalDevice: ret: 0
01-04 07:38:35.275 605 605 E KeyMasterHalDevice: resp->status: -38
01-04 07:38:35.275 605 605 F android.hardware.keymaster@3.0-impl: Configure failed
--------- beginning of crash
01-04 07:38:35.275 605 605 F libc : Fatal signal 6 (SIGABRT), code -6 in tid 605 (android.hardwar), pid 605 (android.hardwar)
01-04 07:38:35.278 605 605 F libc : crash_dump helper failed to exec
01-04 07:38:35.278 605 605 F libc : failed to wait for crash_dump helper: No child processes
01-04 07:38:35.281 606 606 I ServiceManagement: Removing namespace from process name android.hardware.gatekeeper@1.0-service-qti to gatekeeper@1.0-.
01-04 07:38:35.282 572 572 E SELinux : avc: denied { add } for interface=android.hardware.gatekeeper::IGatekeeper pid=606 scontext=u:r:recovery:s0 tcontext=u:object_r:hal_gatekeeper_hwservice:s0 tclass=hwservice_manager permissive=1
01-04 07:38:35.282 606 606 I android.hardware.gatekeeper@1.0-service: Registration complete for android.hardware.gatekeeper@1.0::IGatekeeper/default.
01-04 07:38:35.289 576 576 I recovery: type=1400 audit(0.0:77): avc: denied { write } for name="etc" dev="rootfs" ino=13744 scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
01-04 07:38:35.289 576 576 I recovery: type=1400 audit(0.0:78): avc: denied { add_name } for name="mtab" scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
01-04 07:38:35.289 576 576 I recovery: type=1400 audit(0.0:79): avc: denied { create } for name="mtab" scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=lnk_file permissive=1
01-04 07:38:35.289 576 576 I recovery: type=1400 audit(0.0:80): avc: denied { create } for name="firmware" scontext=u:r:recovery:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
01-04 07:38:35.291 576 576 I ArmToArm64Assembler: generated scanline__00000077:03545401_00000A01_00000000 [ 69 ipp] (113 ins) at [0x7d5f458790:0x7d5f458954] in 50573 ns
01-04 07:38:35.297 576 576 I ArmToArm64Assembler: generated scanline__00000077:03545401_00000A08_00000000 [ 69 ipp] (116 ins) at [0x7d5f458960:0x7d5f458b30] in 37917 ns
01-04 07:38:35.299 576 576 I recovery: type=1400 audit(0.0:81): avc: denied { getattr } for path="/persist/.twrps_wzsx150" dev="sda14" ino=296 scontext=u:r:recovery:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
03-23 20:44:47.357 576 576 E cutils-trace: Error opening trace file: No such file or directory (2)
03-23 20:44:47.358 572 572 W /sbin/hwservicemanager: Cannot open /system/manifest.xml
03-23 20:44:47.487 592 593 I adbd : functionfs successfully initialized
03-23 20:44:47.488 592 593 I adbd : registering usb transport
03-23 20:44:47.489 592 627 E cutils-trace: Error opening trace file: No such file or directory (2)
03-23 20:44:48.360 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
03-23 20:44:50.361 576 576 I chatty : uid=0(root) /sbin/recovery identical 2 lines
03-23 20:44:51.361 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
03-23 20:44:52.171 631 631 E cutils-trace: Error opening trace file: No such file or directory (2)
03-23 20:44:52.172 572 572 W /sbin/hwservicemanager: Cannot open /system/manifest.xml
03-23 20:44:52.172 631 631 D vndksupport: Loading /usr/lib64/hw/android.hardware.keymaster@3.0-impl-qti.so from current namespace instead of sphal namespace.
03-23 20:44:52.175 631 631 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
03-23 20:44:52.175 631 631 D QSEECOMAPI: App is already loaded QSEE and app id = 1
03-23 20:44:52.179 631 631 E KeymasterUtils: TA API Major Verion: 3
03-23 20:44:52.179 631 631 E KeymasterUtils: TA API Minor Verion: 0
03-23 20:44:52.179 631 631 E KeymasterUtils: TA Major Verion: 3
03-23 20:44:52.179 631 631 E KeymasterUtils: TA Minor Verion: 130
03-23 20:44:52.186 631 631 E KeyMasterHalDevice: configure
03-23 20:44:52.186 631 631 E KeyMasterHalDevice: ret: 0
03-23 20:44:52.186 631 631 E KeyMasterHalDevice: resp->status: -38
03-23 20:44:52.186 631 631 F android.hardware.keymaster@3.0-impl: Configure failed
03-23 20:44:52.186 631 631 F libc : Fatal signal 6 (SIGABRT), code -6 in tid 631 (android.hardwar), pid 631 (android.hardwar)
03-23 20:44:52.188 631 631 F libc : crash_dump helper failed to exec
03-23 20:44:52.188 631 631 F libc : failed to wait for crash_dump helper: No child processes
03-23 20:44:52.361 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
03-23 20:44:55.363 576 576 I chatty : uid=0(root) /sbin/recovery identical 3 lines
03-23 20:44:56.363 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
03-23 20:44:57.180 634 634 E cutils-trace: Error opening trace file: No such file or directory (2)
03-23 20:44:57.181 572 572 W /sbin/hwservicemanager: Cannot open /system/manifest.xml
03-23 20:44:57.182 634 634 D vndksupport: Loading /usr/lib64/hw/android.hardware.keymaster@3.0-impl-qti.so from current namespace instead of sphal namespace.
03-23 20:44:57.185 634 634 D QSEECOMAPI: QSEECom_get_handle sb_length = 0xa000
03-23 20:44:57.185 634 634 D QSEECOMAPI: App is already loaded QSEE and app id = 1
03-23 20:44:57.188 634 634 E KeymasterUtils: TA API Major Verion: 3
03-23 20:44:57.188 634 634 E KeymasterUtils: TA API Minor Verion: 0
03-23 20:44:57.188 634 634 E KeymasterUtils: TA Major Verion: 3
03-23 20:44:57.188 634 634 E KeymasterUtils: TA Minor Verion: 130
03-23 20:44:57.195 634 634 E KeyMasterHalDevice: configure
03-23 20:44:57.195 634 634 E KeyMasterHalDevice: ret: 0
03-23 20:44:57.195 634 634 E KeyMasterHalDevice: resp->status: -38
03-23 20:44:57.195 634 634 F android.hardware.keymaster@3.0-impl: Configure failed
03-23 20:44:57.195 634 634 F libc : Fatal signal 6 (SIGABRT), code -6 in tid 634 (android.hardwar), pid 634 (android.hardwar)
03-23 20:44:57.197 634 634 F libc : crash_dump helper failed to exec
03-23 20:44:57.197 634 634 F libc : failed to wait for crash_dump helper: No child processes
03-23 20:44:57.364 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...
03-23 20:45:00.365 576 576 I chatty : uid=0(root) /sbin/recovery identical 3 lines
03-23 20:45:01.365 576 576 W /sbin/recovery: Waited one second for android.hardware.keymaster@3.0::IKeymasterDevice/default. Waiting another...

It keeps cycling the last part once per second.

If I just flash TWRP, but don't wipe or anything and just reboot to system from TWRP, MIUI runs fine.

When I Power the device on with VolUp + power, MI-Recovery 3.0 starts instead of TWRP.