[Vehicle] Audi A4 B9 2016 – MU0678 – Virtual Cockpit: AltScreen on cluster (native Screen B, parked test)

[joeyQuery]

Area

Virtual Cockpit / MOST

Topic

New platform / vehicle

Topic

Vehicle / platform: Audi A4 B9 (2016) / MHI2 Harman

Firmware / MU: MHI2_ER_AUG22_P3241 / MU0678

Cluster: Audi Virtual Cockpit (12.3", [part number / SW version]). The stock map in the cluster uses the MOST video path (2_lvds display mode).

SSH access: [WLAN]

What did you observe?

CarPlay AltScreen (stream 111) now reaches the Virtual Cockpit on the A4 B9. It was tested parked only. The route is native: the stock libairplay Screen-B session machinery and the stock NvSS video path, with libmibr_carplay111.so (LD_PRELOAD in dio_manager) doing only the routing. The stock main-screen session is not touched.

Key findings:

1. Original 6031 port fails because of the firewall. The unit's pf ruleset only admits inbound TCP on carplay0 for 5000:5001, 5010, 6000, 6030, 7000:7001 and 7100, then does block drop in on carplay0 all. Port 6031 is silently dropped, so the phone's connect times out after 10 s (kTimeoutErr -6722). Using an allowed, unused port (6000) fixes it, with no firewall changes.
2. Stream 111 decodes. The phone connected on port 6000 and sent H.264 High L3.1, 1440x456, about 30 fps. A capture ran for about 17 minutes without a drop.
3. The cluster shows the CarPlay alt screen. B's NvSS open call is rewritten (output device 0 -> 1, layer 59 -> 58, B only). The display manager registers a stream-58 displayable, and dmdt sc 4 77 shows it on the cluster.

Item	Value
/mnt/app/eso/lib/libairplay.so SHA-256	a3ab0fe0ac20a712f7f240c1abd852a38faf78f2673880342d0eb24a6d8c29be
Display manager	2_lvds: display 0 = main (TFTLCD0, 1024x480, ctx 78 {16, 59}); display 4 = cluster (HDMI0, 1440x542, stock ctx 74 {20,102,101,33})
Alt screen context	77 {20,102,101,58}
NvssVideoImpl	vtable at 0xa92e8; start calls NvSSVideoOpen with output device from NVSS_VIDEO_OUTPUT_DEVICE (<=1) and layer byte

Not yet verified:

• The cluster context switch is still manual (dmdt sc 4 77 and back to 74).
• Placement and size on the 1440x542 display (the stream is 1440x456).
• Behaviour on unplug and reconnect.
• After leaving CarPlay for the native MMI and returning, the main screen briefly blacked out or lagged. I traced this to the original receiver path advertising the blocked port. A build that fixes it (r7) exists but is still untested on the car.

Source / provenance

• native_b.inc and libaltscreen111_gen2.c (my fork).
• Static analysis of libairplay (NvssVideoImpl vtable, NvSSVideoOpen parameters).
• displaymanager.json, dmdt gd/gs/gc.
• The live pf ruleset from the unit.

Evidence

Unit log lines: Screen B ready ... dataPort=6000, iPhone connected on stream-111 port 6000, NvSSVideoOpen rewrite: outputDevice 0 -> 1, layerID 59 -> 58, real start -> 0, decode#N ... real_rc=0. Nothing from the dump with personal data is attached.

Why it matters

The same blocked-port problem probably affects other MHI2 units with this pf ruleset. Using a port the firewall already allows (6000, 5010, 7100 or 5001) avoids both the 10 s timeout and any firewall changes.

Context / evidence

Parked tests only, not tested while driving.

Context / evidence

No response

Before posting

• I removed credentials, VINs, addresses and other private information.