[Samsung Galaxy S7 Guides, News, & Discussion] Wootever:
Not sure if this has already been posted, but i might found a workaround for device encryption on custom kernels.

Only works if Secure startup is disabled, otherwise it will brick the data partition.

The Kernel panics are caused by ICCC_save_data or get_sec_TIMA_address:

<6>[ 57.767167] [6: kworker/6:8: 3906] Trustonic TEE: b01|ICCC:Trustlet ICCC::Starting
<6>[ 57.768234] [7: kworker/7:1: 756] Trustonic TEE: b01|TL ICCC: we got a command: 2
<6>[ 57.768247] [7: kworker/7:1: 756] Trustonic TEE: b01|ICCC :case ICCC_SAVEDATA_TA
<6>[ 57.768259] [7: kworker/7:1: 756] Trustonic TEE: b01|ICCC : In save data, type = ff200000 , value = 1
<6>[ 57.768268] [7: kworker/7:1: 756] Trustonic TEE: b01|iccc: ICCC_save_data@#
<2>[ 57.768551] [1: Binder_3: 3942] Bad mode in Error handler detected, code 0xbf000000

<6>[ 55.799830] [4: kworker/4:2: 3141] Trustonic TEE: b01|TL_TZ_KEYSTORE: Starting
<6>[ 55.800951] [6: kworker/6:2: 1910] Trustonic TEE: b01|TL_TZ_KEYSTORE: Got a message!
<6>[ 55.800963] [6: kworker/6:2: 1910] Trustonic TEE: b01|TZ_KEYSTORE: we got a command
<6>[ 55.800971] [6: kworker/6:2: 1910] Trustonic TEE: b01|TZ_KEYSTORE: process_cmd: CMD_TZ_KEYSTORE_init:
<6>[ 55.802504] [7: kworker/7:2: 7181] Trustonic TEE: b01|TIMA trustlet: get_sec_TIMA_address tima_sec_mem_addr : FE400000
<2>[ 55.803784] [1: android.ui: 3606] Bad mode in Error handler detected, code 0xbf000000

<6>[ 57.402718] [0: kworker/0:1: 1155] Trustonic TEE: d01|TL_TZ_KEYSTORE: Starting
<6>[ 57.406039] [7: kworker/7:2: 4827] Trustonic TEE: d01|TL_TZ_KEYSTORE: Got a message!
<6>[ 57.406051] [7: kworker/7:2: 4827] Trustonic TEE: d01|TZ_KEYSTORE: we got a command
<6>[ 57.406060] [7: kworker/7:2: 4827] Trustonic TEE: d01|TZ_KEYSTORE: process_cmd: CMD_TZ_KEYSTORE_init:
<6>[ 57.406068] [7: kworker/7:2: 4827] Trustonic TEE: d01|TIMA trustlet: get_sec_TIMA_address tima_sec_mem_addr : FE400000
[...]
<3>[ 69.458475] [3: system_server: 3564] Trustonic TEE: wait_mcp_notification: No answer after 10s
[...]
<0>[ 69.461397] [3: system_server: 3564] Kernel panic - not syncing: tbase halt

But on early kernel/system initialization ICCC_save_data and get_sec_TIMA_address will be correctly executed and then call up "drTima".

<6>[ 6.131630] [1: kworker/1:1: 3044] Trustonic TEE: 901|iccc: ICCC_save_data@#
<6>[ 6.131641] [1: kworker/1:1: 3044] Trustonic TEE: 601|drTima: processing TIMA_DRIVER_PHYS_MEM_ACCESS_COPY

<6>[ 37.632381] [2: kworker/2:2: 6536] Trustonic TEE: d01|TIMA trustlet: get_sec_TIMA_address tima_sec_mem_addr : FE400000
<6>[ 37.632392] [2: kworker/2:2: 6536] Trustonic TEE: 601|drTima: processing TIMA_DRIVER_PHYS_MEM_ACCESS_COPY

Which is part of ffffffffd0000000000000000000000a.tlbin

grep -r drTima
ffffffffd0000000000000000000000a.tlbin

ffffffffd0000000000000000000000a.tlbin then again is referenced on the ramdisk init.rc:

service mobicore /system/bin/mcDriverDaemon -r /system/app/FFFFFFFF000000000000000000000001.drbin -r /system/app/mcRegistry/ffffffffd0000000000000000000000a.tlbin -r /system/app/mcRegistry/ffffffffd00000000000000000000016.tlbin

When the mcDriverDaemon is loading ffffffffd0000000000000000000000a.tlbin it will panic the kernel after ~30+ seconds.

(Might be a verification check or something else that interferes with this binary, identifying the cause could provide a proper fix.)

Unfortunately it is also needed for device decryption.

However, if the MobiCore service is stopped right after system initialization and then re-started without the TIMA binary, the decrypted device can be used without kernel panic:

# MobiCore startup
service mobicore /system/bin/mcDriverDaemon -r /system/app/FFFFFFFF000000000000000000000001.drbin -r /system/app/mcRegistry/ffffffffd0000000000000000000000a.tlbin -r /system/app/mcRegistry/ffffffffd00000000000000000000016.tlbin
class core
user system
group system

service fingerprint /system/bin/mcDriverDaemon -r /system/app/FFFFFFFF000000000000000000000001.drbin -r /system/app/mcRegistry/ffffffffd00000000000000000000016.tlbin
class core
user system
group system
disabled

on property:sys.boot_completed=1
stop mobicore
start fingerprint

FFFFFFFF000000000000000000000001.drbin = RPMB

ffffffffd0000000000000000000000a.tlbin = TIMA / ICCC / Encryption

ffffffffd00000000000000000000016.tlbin = Key Manager / Fingerprint