[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Yes, just proved that - I've managed to boot xfl kernel binary, just with patched ramdisk and android security patch level word, so it could boot as runtime kernel.

This means qseecom and all drivers are those of xfl. Another reason for size difference is that android kernel's initramfs is simply bigger than the one of xfl kernel.

$ adb shell
~ # cat /proc/version
Linux version 4.4.78-perf+ (hudsonslave@seldlx11356) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Wed May 9 12:17:40 CEST 2018

The rest of the log is practically the same as the previous test.

~ # ps -ef | grep -v ' \['
PID USER TIME COMMAND
1 root 0:02 /init
588 root 0:01 /sbin/ueventd
591 root 0:00 /sbin/adbd --device_banner=recovery
619 root 0:00 /system/bin/logd
629 root 0:02 /system/bin/loader -g/dev/fs -llog.log -sufs
634 root 0:00 logcat
641 root 0:00 /system/bin/sh -
644 root 0:00 ps -ef
645 root 0:00 grep -v \[
~ # exit

$ fastboot getvar all
(bootloader) version:0.4-SONY-0.31
(bootloader) max-download-size:104857600
(bootloader) Version-sony:0.31
(bootloader) Loader-version:XFL-MSM8998-N-47
(bootloader) serialno:BH900xxxxx
(bootloader) version-bootloader:1306-5035_X_Boot_MSM8998_LA2.0_P_114
(bootloader) version-baseband:1307-7511_47.2.A.10.107
(bootloader) product:G8441
(bootloader) Phone-id:0000:xxxxxxxxxxxxxx
(bootloader) Rooting-status:<empty>
(bootloader) Device-id:xxxxxxxx
(bootloader) Platform-id:2005E0E1
(bootloader) Frp-partition:frp
(bootloader) secure:<empty>
(bootloader) Sector-size:4096
(bootloader) Ufs-info:SKhynix,H28U62301AMR,D003
(bootloader) Keystore-counter:0
(bootloader) Sake-root:D159
(bootloader) Default-security:eek:N
(bootloader) S1-root:S1_Root_e69c
(bootloader) Security-state:162509AE6B4B54D487F2496DDC4D4B6C6747A73B
(bootloader) USB-version:0x0200
(bootloader) slot-count:0
(bootloader) slot-suffixes:<empty>
(bootloader) current-slot:<empty>
all:
finished. total time: 0.108s

$ adb shell
~ # cat /log.log
INIT: Sat Feb 13 05:01:20 1971
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:367]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for Rooting-status
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:409]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for secure
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ authenticate.c:595]:
Failed to get key. (-1007)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ fastboot.c:3315]:
get_value failed for slot-suffixes
[ERROR @ fastboot.c:3315]:
get_value failed for current-slot
~ #

~ # logcat -d
02-13 04:59:47.489 1 1 I init : type=1400 audit(0.0:440): avc: denied { mounton } for path="/dev/usb-ffs/adb" dev="functionfs" ino=41090 scontext=u:r:kernel:s0 tcontext=u:object_r:functionfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:441): avc: denied { read write } for name="sda1" dev="tmpfs" ino=20455 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:442): avc: denied { open } for path="/dev/block/sda1" dev="tmpfs" ino=20455 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:443): avc: denied { dac_override } for capability=1 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:444): avc: denied { read write } for name="ep0" dev="functionfs" ino=41165 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:445): avc: denied { open } for path="/dev/fs/ep0" dev="functionfs" ino=41165 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.489 629 629 I loader : type=1400 audit(0.0:446): avc: denied { connectto } for path="/dev/socket/property_service" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:447): avc: denied { read } for name="present" dev="sysfs" ino=38098 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:448): avc: denied { open } for path="/sys/devices/soc/800f000.qcom,spmi/spmi-0/spmi0-02/800f000.qcom,spmi:qcom,pmi8998@2:qcom,qpnp-smb2/power_supply/usb/present" dev="sysfs" ino=38098 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:449): avc: denied { write } for name="charging_enabled" dev="sysfs" ino=38211 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:47.499 1 1 I init : type=1400 audit(0.0:450): avc: denied { remove_name } for name="f1" dev="configfs" ino=41116 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 04:59:47.499 1 1 I init : type=1400 audit(0.0:452): avc: denied { unlink } for name="f1" dev="configfs" ino=41116 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=lnk_file permissive=1 ppid=0 pcomm="swapper/0"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:451): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:453): avc: denied { bind } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:47.499 629 629 I loader : type=1400 audit(0.0:454): avc: denied { read } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=629 pgcomm="loader"
02-13 04:59:48.079 633 633 I loader : type=1400 audit(0.0:455): avc: denied { execute_no_trans } for path="/system/bin/toybox" dev="tmpfs" ino=9821 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.089 633 633 I tar : type=1400 audit(0.0:456): avc: denied { write } for name="firmware" dev="tmpfs" ino=9843 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.089 633 633 I tar : type=1400 audit(0.0:457): avc: denied { add_name } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.089 633 633 I tar : type=1400 audit(0.0:458): avc: denied { create } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.089 633 633 I tar : type=1400 audit(0.0:459): avc: denied { write } for path="/system/etc/firmware/tzloader.b00" dev="tmpfs" ino=18447 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.089 633 633 I tar : type=1400 audit(0.0:460): avc: denied { setattr } for name="tzloader.b00" dev="tmpfs" ino=18447 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=629 pcomm="loader" pgid=629 pgcomm="loader"
02-13 04:59:48.099 629 629 I loader : type=1400 audit(0.0:461): avc: denied { ioctl } for path="/dev/qseecom" dev="tmpfs" ino=39195 ioctlcmd=970a scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=chr_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 04:59:48.110 629 629 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x2000
02-13 04:59:48.111 629 629 D QSEECOMAPI: App is not loaded in QSEE
02-13 04:59:48.111 629 629 D QSEECOMAPI: app_arch = 1, total_files = 9
02-13 04:59:48.145 629 629 D QSEECOMAPI: Loaded image: APP id = 196611
02-13 04:59:53.119 591 591 I adbd : type=1400 audit(0.0:462): avc: denied { sendto } for path="/dev/socket/logdw" scontext=u:r:adbd:s0 tcontext=u:r:shell:s0 tclass=unix_dgram_socket permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:00:30.179 641 641 I sh : type=1400 audit(0.0:463): avc: denied { getattr } for path="/proc/version" dev="proc" ino=4026532113 scontext=u:r:adbd:s0 tcontext=u:object_r:proc_version:s0 tclass=file permissive=1 ppid=591 pcomm="adbd" pgid=591 pgcomm="adbd"
02-13 05:00:30.759 643 643 I cat : type=1400 audit(0.0:464): avc: denied { read } for name="version" dev="proc" ino=4026532113 scontext=u:r:adbd:s0 tcontext=u:object_r:proc_version:s0 tclass=file permissive=1 ppid=641 pcomm="sh" pgid=641 pgcomm="sh"
02-13 05:00:30.759 643 643 I cat : type=1400 audit(0.0:465): avc: denied { open } for path="/proc/version" dev="proc" ino=4026532113 scontext=u:r:adbd:s0 tcontext=u:object_r:proc_version:s0 tclass=file permissive=1 ppid=641 pcomm="sh" pgid=641 pgcomm="sh"
02-13 05:01:20.349 629 629 I loader : type=1400 audit(0.0:466): avc: denied { sys_rawio } for capability=17 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:01:20.378 629 629 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x1000
02-13 05:01:20.379 629 629 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
02-13 05:01:20.369 629 629 I loader : type=1400 audit(0.0:467): avc: denied { append } for path="/log.log" dev="tmpfs" ino=39243 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:01:20.369 629 629 I loader : type=1400 audit(0.0:468): avc: denied { getattr } for path="/dev/null" dev="tmpfs" ino=39167 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=chr_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:01:20.369 629 629 I loader : type=1400 audit(0.0:469): avc: denied { ioctl } for path="/dev/block/sda" dev="tmpfs" ino=20450 ioctlcmd=1268 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:01:20.399 629 629 I loader : type=1400 audit(0.0:470): avc: denied { read write } for name="bcdUSB" dev="configfs" ino=39244 scontext=u:r:shell:s0 tcontext=u:object_r:configfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 05:01:20.399 629 629 I loader : type=1400 audit(0.0:471): avc: denied { open } for path="/config/usb_gadget/g1/bcdUSB" dev="configfs" ino=39244 scontext=u:r:shell:s0 tcontext=u:object_r:configfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
~ #

This proves in my opinion, that XFL mode uses different qseecom/TZ api (or physical memory interface), which is not available in normal or recovery boot mode (I've tested it this time in recovery mode, having it flashed in FOTAkernel/recovery partition).