[Xiaomi Redmi Note 3 Questions & Answers] eukela:
I took a look at the logs of my current system, nightly cm13 + agni 2.7 MM kernel, during an attempt to enable encryption. The main showstopper seems to be the error "QSEECOM: __qseecom_update_cmd_buf: QSEE app arch 0 is not supported" from drivers/misc/qseecom.c

A few theories and what I've checked:

"app" file got corrupted. Looks like it's referring to /firmware/image/keymaste.mdt here. But the file looks ok, 5th byte that it calls app_arch was 0x01, and it's a stock rom file, not updated by any cyanogenmod build. (My keymaste.mdt's md5 is 916ab2c54fac42a5dfcd3b9ade8e1869, btw.)

Bug in closed source blob libQSEEComAPI.so which sits between kernel and "Keymaster QCOM HAL" (keymaster_qcom.cpp) - but the blob is the same in both builds, and the .cpp also has seen no recent changes as far as I can tell.

A bug in kernel which zeroes out app_arch. qseecom_query_app_loaded() looks suspicious, it sets data->client.app_arch = 0. The code around it mentions that that crap was written for the case when 'app was loaded by appsbl before and was not registered', so sounds like it may be influenced by changes to boot sequence.

logcat:
11-09 21:31:12.762 1034 3173 D CryptdConnector: SND -> {7 cryptfs enablecrypto inplace pattern [scrubbed]}
11-09 21:31:18.363 372 379 D Cryptfs : unmounting /data succeeded
11-09 21:31:18.364 372 379 I Cryptfs : keymaster module name is Keymaster QCOM HAL
11-09 21:31:18.364 372 379 I Cryptfs : keymaster version is 3
11-09 21:31:18.364 372 379 I Cryptfs : Found keymaster0 module, using keymaster0 API.
11-09 21:31:18.364 372 379 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
11-09 21:31:18.364 372 379 D QSEECOMAPI: : App is already loaded QSEE and app id = 3
11-09 21:31:18.366 372 379 D QSEECOMAPI: : QSEECom_dealloc_memory
11-09 21:31:18.366 372 379 D QSEECOMAPI: : QSEECom_shutdown_app, app_id = 3
11-09 21:31:18.366 372 379 I Cryptfs : keymaster module name is Keymaster QCOM HAL
11-09 21:31:18.366 372 379 I Cryptfs : keymaster version is 3
11-09 21:31:18.366 372 379 I Cryptfs : Found keymaster0 module, using keymaster0 API.
11-09 21:31:18.367 372 379 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
11-09 21:31:18.367 372 379 D QSEECOMAPI: : App is already loaded QSEE and app id = 3
11-09 21:31:19.787 372 379 D QSEECOMAPI: : QSEECom_dealloc_memory
11-09 21:31:19.787 372 379 D QSEECOMAPI: : QSEECom_shutdown_app, app_id = 3
11-09 21:31:19.788 372 379 I Cryptfs : Using scrypt with keymaster for cryptfs KDF
11-09 21:31:20.241 372 379 I Cryptfs : keymaster module name is Keymaster QCOM HAL
11-09 21:31:20.241 372 379 I Cryptfs : keymaster version is 3
11-09 21:31:20.241 372 379 I Cryptfs : Found keymaster0 module, using keymaster0 API.
11-09 21:31:20.242 372 379 D QSEECOMAPI: : QSEECom_get_handle sb_length = 0x2000
11-09 21:31:20.242 372 379 D QSEECOMAPI: : App is already loaded QSEE and app id = 3
11-09 21:31:20.244 372 379 I Cryptfs : Signing safely-padded object
[b]11-09 21:31:20.258 372 379 E QSEECOMAPI: : Error::send modified command ioctl failed wtih ret = -1, errno = 12[/b]
11-09 21:31:20.258 372 379 E QCOMKeyMaster: Sign data command failed resp->status = -1 ret =-1
11-09 21:31:20.258 372 379 D QSEECOMAPI: : QSEECom_dealloc_memory
11-09 21:31:20.258 372 379 D QSEECOMAPI: : QSEECom_shutdown_app, app_id = 3
11-09 21:31:20.258 372 379 E Cryptfs : Signing failed
11-09 21:31:20.258 372 379 E Cryptfs : scrypt failed
11-09 21:31:20.258 372 379 E Cryptfs : Cannot create encrypted master key
11-09 21:31:20.258 372 379 E Cryptfs : Error enabling encryption after framework is shutdown, no data changed, restarting system

dmesg:
[b][ 147.764392] QSEECOM: __qseecom_update_cmd_buf: QSEE app arch 0 is not supported[/b]
[ 147.770985] QSEECOM: qseecom_ioctl: failed qseecom_send_cmd: -12
[ 147.779936] SysRq : Emergency Remount R/O
[ 147.791008] EXT4-fs (mmcblk0p25): re-mounted. Opts: (null)
[ 147.811232] Emergency Remount complete
[ 147.885299] dynamic fsync: reboot - force flush!