[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
xfl lilo/loader started under normal android kernel (stock from 10.107 fw), with external module for /dev/mem access:

$ lsusb -d 0fce:b00b -v 2>&1 | grep iInterface
iInterface 5 XFL
iInterface 6 ADB Interface

$ adb shell
~ # ps -ef | grep -v ' \['
PID USER TIME COMMAND
1 root 0:02 /init
715 root 0:00 /sbin/ueventd
718 root 0:00 /sbin/adbd --device_banner=recovery
773 root 0:00 /system/bin/logd
788 root 0:00 /system/bin/loader -g/dev/fs -llog.log -sufs
795 root 0:00 /system/bin/sh -
800 root 0:00 logcat
804 root 0:00 ps -ef
805 root 0:00 grep -v \[
~ # cat /log.log
cat: can't open '/log.log': No such file or directory
~ # exit

$ fastboot getvar all
(bootloader) version:0.4-SONY-0.31
(bootloader) max-download-size:104857600
(bootloader) Version-sony:0.31
(bootloader) Loader-version:XFL-MSM8998-N-47
(bootloader) serialno:BH900xxxxx
(bootloader) version-bootloader:1306-5035_X_Boot_MSM8998_LA2.0_P_114
(bootloader) version-baseband:1307-7511_47.2.A.10.107
(bootloader) product:G8441
(bootloader) Phone-id:0000:xxxxxxxxxxxxxx
[B](bootloader) Rooting-status:<empty>[/B]
(bootloader) Device-id:xxxxxxxx
(bootloader) Platform-id:2005E0E1
(bootloader) Frp-partition:frp
[B](bootloader) secure:<empty>[/B]
(bootloader) Sector-size:4096
(bootloader) Ufs-info:SKhynix,H28U62301AMR,D003
(bootloader) Keystore-counter:0
(bootloader) Sake-root:D159
(bootloader) Default-security:eek:N
(bootloader) S1-root:S1_Root_e69c
(bootloader) Security-state:162509AE6B4B54D487F2496DDC4D4B6C6747A73B
(bootloader) USB-version:0x0200
(bootloader) slot-count:0
(bootloader) slot-suffixes:<empty>
(bootloader) current-slot:<empty>
all:
finished. total time: 0.104s

$ adb shell
~ # cat /log.log
INIT: Sat Feb 13 01:52:39 1971
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:367]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for Rooting-status
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:409]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for secure
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ authenticate.c:595]:
Failed to get key. (-1007)
[ERROR @ xflattest_int.c:82]:
xflattest returned error (-3)
[ERROR @ fastboot.c:3315]:
get_value failed for slot-suffixes
[ERROR @ fastboot.c:3315]:
get_value failed for current-slot
~ #

adb logcat log:

02-13 01:51:50.539 1 1 I init : type=1400 audit(0.0:447): avc: denied { mounton } for path="/dev/usb-ffs/adb" dev="functionfs" ino=569 scontext=u:r:kernel:s0 tcontext=u:object_r:functionfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:448): avc: denied { read } for name="present" dev="sysfs" ino=43922 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:449): avc: denied { open } for path="/sys/devices/soc/800f000.qcom,spmi/spmi-0/spmi0-02/800f000.qcom,spmi:qcom,pmi8998@2:qcom,qpnp-smb2/power_supply/usb/present" dev="sysfs" ino=43922 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:450): avc: denied { write } for name="charging_enabled" dev="sysfs" ino=44037 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:451): avc: denied { read write } for name="sda1" dev="tmpfs" ino=505 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:452): avc: denied { open } for path="/dev/block/sda1" dev="tmpfs" ino=505 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:453): avc: denied { dac_override } for capability=1 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:454): avc: denied { read write } for name="ep0" dev="functionfs" ino=649 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:455): avc: denied { open } for path="/dev/fs/ep0" dev="functionfs" ino=649 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:456): avc: denied { connectto } for path="/dev/socket/property_service" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:457): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:458): avc: denied { bind } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 1 1 I init : type=1400 audit(0.0:459): avc: denied { remove_name } for name="f1" dev="configfs" ino=595 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 01:51:50.549 788 788 I loader : type=1400 audit(0.0:460): avc: denied { read } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=788 pgcomm="loader"
02-13 01:51:50.549 1 1 I init : type=1400 audit(0.0:461): avc: denied { unlink } for name="f1" dev="configfs" ino=595 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=lnk_file permissive=1 ppid=0 pcomm="swapper/0"
02-13 01:51:50.552 721 721 E adbd : remote usb: read terminated (message): No such device
02-13 01:51:50.553 718 718 I adbd : closing functionfs transport
02-13 01:51:50.670 718 719 I adbd : initializing functionfs
02-13 01:51:50.670 718 719 I adbd : functionfs successfully initialized
02-13 01:51:50.670 718 719 I adbd : registering usb transport
02-13 01:51:51.289 794 794 I loader : type=1400 audit(0.0:462): avc: denied { execute_no_trans } for path="/system/bin/toybox" dev="tmpfs" ino=16926 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
02-13 01:51:51.309 794 794 I tar : type=1400 audit(0.0:463): avc: denied { write } for name="firmware" dev="tmpfs" ino=16948 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
02-13 01:51:51.309 794 794 I tar : type=1400 audit(0.0:464): avc: denied { add_name } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
02-13 01:51:51.309 794 794 I tar : type=1400 audit(0.0:465): avc: denied { create } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
02-13 01:51:51.309 794 794 I tar : type=1400 audit(0.0:466): avc: denied { write } for path="/system/etc/firmware/tzloader.b00" dev="tmpfs" ino=19508 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
[B]02-13 01:51:51.309 794 794 I tar : type=1400 audit(0.0:467): avc: denied { setattr } for name="tzloader.b00" dev="tmpfs" ino=19508 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=788 pcomm="loader" pgid=788 pgcomm="loader"
02-13 01:51:51.309 788 788 I loader : type=1400 audit(0.0:468): avc: denied { ioctl } for path="/dev/qseecom" dev="tmpfs" ino=41887 ioctlcmd=970a scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=chr_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"[/B]
02-13 01:51:51.315 788 788 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x2000
02-13 01:51:51.315 788 788 D QSEECOMAPI: App is not loaded in QSEE
02-13 01:51:51.315 788 788 D QSEECOMAPI: app_arch = 1, total_files = 9
02-13 01:51:51.350 788 788 D QSEECOMAPI: Loaded image: APP id = 196611
02-13 01:52:39.159 788 788 I loader : type=1400 audit(0.0:469): avc: denied { sys_rawio } for capability=17 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:52:39.175 788 788 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x1000
02-13 01:52:39.175 788 788 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
02-13 01:52:39.169 788 788 I loader : type=1400 audit(0.0:470): avc: denied { append } for path="/log.log" dev="tmpfs" ino=43659 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:52:39.199 788 788 I loader : type=1400 audit(0.0:473): avc: denied { read write } for name="bcdUSB" dev="configfs" ino=43660 scontext=u:r:shell:s0 tcontext=u:object_r:configfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 01:52:39.199 788 788 I loader : type=1400 audit(0.0:474): avc: denied { open } for path="/config/usb_gadget/g1/bcdUSB" dev="configfs" ino=43660 scontext=u:r:shell:s0 tcontext=u:object_r:configfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"

From the lilo/loader log it seems it uses different qseecom api than normal kernel to obtain rooting status and sec data.