Secure Element service crash logged every 5 seconds

[ZimbiX]

I happened to be checking out what was shown in adb logcat (to attempt some investigation into the issue of the screen randomly locking) when I noticed a process had crashed. And in fact, it consistently crashes every five seconds!

Each crash is the same, with the only difference I've noticed being that D AEE_AED : Count: 415 gets incremented.

I'm not clear on what /vendor/bin/hw/android.hardware.secure_element@1.0-service does. I'd initially suspected it was to do with the fingerprint reader, but from some Googling, I think it's related to NFC. Disabling NFC didn't make the crashes stop though.

The crash log mentions ese_config.cpp:50] Check failed: config_path != "", which I think could be referencing this Android source code. Which would seem to indicate that the device is missing a config file, libese-nxp.conf, from any of /odm/etc/, /vendor/etc/, or /etc/.

I haven't tried to use NFC yet, but I wonder whether it's working correctly.

I don't know if I've done something to cause this crashing, but I think it unlikely - I'd appreciate it if someone else could confirm they see this too. Do you have this crashing? Is NFC working? And have you rooted?

I reckon this crashing would be having an adverse impact on battery life, so it'd be good to get it sorted out. I'm going to try to see if I can find/create a suitable libese-nxp.conf. I've found a couple of examples (for other devices):

- https://android.googlesource.com/device/goo...libese-nxp.conf
- https://review.lineageos.org/c/LineageOS/an...ese-nxp.conf#13

Or maybe the Cosmo doesn't actually have a Secure Element and its NFC works without it (I don't know how this stuff is supposed to work) - I haven't found much from Googling 'Secure Element' with 'MT6771V/CT' or 'Helio P70'. If it doesn't have one, we should find out how to disable this service which would then seem to be unnecessary.

I haven't found libese-nxp.conf in the directories mentioned, but there are the below config files. Maybe they're used instead:

- /vendor/etc/libnfc-nci.conf
- /vendor/etc/libnfc-nxp.conf

To aid readability, I've attached a screenshot of the same logs shown in Sublime using the ADB syntax highlighting. And I've attached a copy of the above files.

Code: [Select]

12-04 17:59:41.228 15651 15651 D nxpese@1.0-service: Initializing State Machine...
12-04 17:59:41.228 15651 15651 D StateMachine: ProcessExtEvent: enter state:1 event:5
12-04 17:59:41.228 15651 15651 D StateMachine: ProcessExtEvent: exit state:1
12-04 17:59:41.228 15651 15651 D nxpese@1.0-service: Registering SecureElement HALIMPL Service v1.0...
12-04 17:59:41.229 15651 15651 F /vendor/bin/hw/android.hardware.secure_element@1.0-service: ese_config.cpp:50] Check failed: config_path != ""
12-04 17:59:41.229 15651 15651 F libc    : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 15651 (android.hardwar), pid 15651 (android.hardwar)
12-04 17:59:41.256 15654 15654 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone
12-04 17:59:41.257   843   843 I /system/bin/tombstoned: received crash request for pid 15651
12-04 17:59:41.258 15654 15654 I crash_dump64: performing dump of process 15651 (target tid = 15651)
12-04 17:59:41.260 15654 15654 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
12-04 17:59:41.260 15654 15654 F DEBUG   : Build fingerprint: 'Planet/Cosmo_Communicator/Cosmo_Communicator:9/PPR1.180610.011/1563439284:user/release-keys'
12-04 17:59:41.260 15654 15654 F DEBUG   : Revision: '0'
12-04 17:59:41.260 15654 15654 F DEBUG   : ABI: 'arm64'
12-04 17:59:41.260 15654 15654 F DEBUG   : pid: 15651, tid: 15651, name: android.hardwar  >>> /vendor/bin/hw/android.hardware.secure_element@1.0-service <<<
12-04 17:59:41.260 15654 15654 F DEBUG   : signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
12-04 17:59:41.260 15654 15654 F DEBUG   : Abort message: 'ese_config.cpp:50] Check failed: config_path != "" '
12-04 17:59:41.260 15654 15654 F DEBUG   :     x0  0000000000000000  x1  0000000000003d23  x2  0000000000000006  x3  0000000000000008
12-04 17:59:41.260 15654 15654 F DEBUG   :     x4  0000000000000000  x5  0000000000000000  x6  0000000000000000  x7  7d1b062b070c3c5a
12-04 17:59:41.260 15654 15654 F DEBUG   :     x8  0000000000000083  x9  00000079bafb8b40  x10 fffffff87fffffdf  x11 0000000000000001
12-04 17:59:41.260 15654 15654 F DEBUG   :     x12 00000079ba60d6b0  x13 0000000000000001  x14 ffffffffff000000  x15 5a3c0c072b061b7d
12-04 17:59:41.260 15654 15654 F DEBUG   :     x16 00000079baff12c8  x17 00000079baf2f2d8  x18 0000007fd43d3c9a  x19 0000000000003d23
12-04 17:59:41.260 15654 15654 F DEBUG   :     x20 0000000000003d23  x21 0000000000000083  x22 0000007fd43d4a51  x23 0000000000000003
12-04 17:59:41.260 15654 15654 F DEBUG   :     x24 00000079bb74f5e0  x25 0000000000000000  x26 0000000000000000  x27 0000000000000000
12-04 17:59:41.260 15654 15654 F DEBUG   :     x28 0000000000000000  x29 0000007fd43d4990
12-04 17:59:41.260 15654 15654 F DEBUG   :     sp  0000007fd43d4950  lr  00000079baf23a90  pc  00000079baf23abc
12-04 17:59:41.263 15654 15654 F DEBUG   :
12-04 17:59:41.263 15654 15654 F DEBUG   : backtrace:
12-04 17:59:41.263 15654 15654 F DEBUG   :     #00 pc 0000000000021abc  /system/lib64/libc.so (abort+124)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #01 pc 00000000000081d4  /system/lib64/vndk-sp-28/libbase.so (android::base::DefaultAborter(char const*)+12)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #02 pc 0000000000008d2c  /system/lib64/vndk-sp-28/libbase.so (android::base::LogMessage::~LogMessage()+724)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #03 pc 000000000000fb88  /vendor/lib64/ese_spi_nxp.so (EseConfig::EseConfig()+1112)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #04 pc 000000000000fdf4  /vendor/lib64/ese_spi_nxp.so (EseConfig::getString(std::__1::basic_string, std::__1::allocator> const&, std::__1::basic_string, std::__1::allocator>)+172)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #05 pc 00000000000030fc  /vendor/bin/hw/android.hardware.secure_element@1.0-service (main+244)
12-04 17:59:41.264 15654 15654 F DEBUG   :     #06 pc 00000000000ae760  /system/lib64/libc.so (__libc_init+88)
12-04 17:59:41.284   375   375 D AEE_AED : $===AEE===AEE===AEE===$
12-04 17:59:41.285   375   375 D AEE_AED : p 2 poll events 1 revents 1
12-04 17:59:41.285   375   375 D AEE_AED : PPM cpu cores:8, online:8
12-04 17:59:41.285   375   375 D AEE_AED : aed_main_fork_worker: generator 0x721962d2c0, worker 0x7fed88c320, recv_fd 10
12-04 17:59:41.288 15657 15657 D AEE_AED : u:r:hal_secure_element_default:s0
12-04 17:59:41.288 15657 15657 V AEE_AED : dashboard_record_update() : rec->module = /vendor/bin/hw/android.hardware.secure_element@1.0-service
12-04 17:59:41.288 15657 15657 D AEE_AED : Skip duplicated exception !
12-04 17:59:41.288 15657 15657 D AEE_AED : Exception Class: 3
12-04 17:59:41.288 15657 15657 D AEE_AED : Module: /vendor/bin/hw/android.hardware.secure_element@1.0-service
12-04 17:59:41.288 15657 15657 D AEE_AED : Count: 415
12-04 17:59:41.288 15657 15657 D AEE_AED : Last exception time: 1575442776
12-04 17:59:41.288 15657 15657 D AEE_AED :
12-04 17:59:41.288 15657 15657 V AEE_AED : aed_crash_dump_session - skipped
12-04 17:59:41.288 15654 15654 I crash_dump: crash_dump_notify exit
12-04 17:59:41.289  1156  1365 W NativeCrashListener: Couldn't find ProcessRecord for pid 15651
12-04 17:59:41.289   375   375 D AEE_AED : clear ppm settings
12-04 17:59:41.290   843   843 E /system/bin/tombstoned: Tombstone written to: /data/tombstones/tombstone_01
12-04 17:59:41.291   375   375 D AEE_AED : $===AEE===AEE===AEE===$

[ZimbiX]

I've managed to disable the service from Termux with:

Code: [Select]

su -c 'mount -o remount,rw /vendor && mv /vendor/bin/hw/android.hardware.secure_element@1.0-service{,.zimbix_disabled}'
That might not be the way you're supposed to do it, but it appears to have worked alright. The crash logs have stopped and I can't see any logging about adverse effects. Plus, I've tested NFC with the MIFARE Classic Tool app by reading my Myki card, and it still recognises it - so I'm thinking this issue is resolved until a proper fix comes from Planet in an OS update.

If you disable it this way, be sure to rename the service back before attempting an OS upgrade.

[vldmr]

Yup, I have the same repeating crash in my logcat. Not sure if it is worth reporting it to PC? Did you report it?

[Ninji]

I tried fixing it by adding my own libese configuration file, but that still doesn't seem to fix it as the Cosmo kernel seems to be missing the related driver...

I don't quite know what it's for but suspect it's to enable something along the lines of the iPhone features where the phone can simulate certain kinds of NFC cards like Suica cards. May be barking up the wrong tree entirely though!

[NVDSYPE]

I did some digging and it can be related to NFC more specifically linked to an e-wallet or e-sim : https://www.justaskgemalto.com/en/what-is-a-secure-element/ and here https://www.rambus.com/blogs/what-is-a-secure-element/ For e-sim: https://docbox.etsi.org/Workshop/2019/20190...ance_CRICCO.pdf