[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
With the kernel patched with following changes

diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c
index c2e87ce24ece..b5d6f0d631a0 100644
--- a/drivers/misc/qseecom.c
+++ b/drivers/misc/qseecom.c
@@ -3142,6 +3142,9 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data,
void *cmd_buf = NULL;
size_t cmd_len;
struct sglist_info *table = data->sglistinfo_ptr;
+	uint32_t *sb = NULL;
+	uint32_t *rb = NULL;
+	int do_hide = 0;

reqd_len_sb_in = req->cmd_req_len + req->resp_len;
/* find app_id & img_name from list */
@@ -3162,6 +3165,22 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data,
return -ENOENT;
}

+	sb = (void *)__qseecom_uvirt_to_kvirt(data,
+	(uintptr_t)req->cmd_req_buf);
+	rb = (void *)__qseecom_uvirt_to_kvirt(data,
+	(uintptr_t)req->resp_buf);
+	printk(KERN_INFO "myQSEE: app=%s\n", data->client.app_name);
+	if (sb != NULL)
+	print_hex_dump(KERN_INFO, "myQSEE req: ", DUMP_PREFIX_OFFSET, 16, 1, sb, req->cmd_req_len, 1);
+	if (rb != NULL)
+	print_hex_dump(KERN_INFO, "myQSEE rsp: ", DUMP_PREFIX_OFFSET, 16, 1, rb, req->resp_len < 256 ? req->resp_len : 256, 1);
+	if (!memcmp(data->client.app_name, "tzxflattest", strlen("tzxflattest")))
+	{
+	if (sb != NULL && rb != NULL)
+	if (sb[0] == 0x07 && sb[1] == 0x04)
+	do_hide = 1;
+	}
+
if (qseecom.qsee_version < QSEE_VERSION_40) {
send_data_req.app_id = data->client.app_id;
send_data_req.req_ptr = (uint32_t)(__qseecom_uvirt_to_kphys(
@@ -3256,6 +3275,37 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data,
ION_IOC_INV_CACHES);
if (ret)
pr_err("cache operation failed %d\n", ret);
+
+	if (sb != NULL)
+	print_hex_dump(KERN_INFO, "myQSEE REQ: ", DUMP_PREFIX_OFFSET, 16, 1, sb, req->cmd_req_len, 1);
+	if (rb != NULL)
+	print_hex_dump(KERN_INFO, "myQSEE RSP: << ", DUMP_PREFIX_OFFSET, 16, 1, rb, req->resp_len < 256 ? req->resp_len : 256, 1);
+
+	if (do_hide) {
+	if (rb[0] == 0) {
+	if (strncmp((uint8_t *)rb + 0x31,
+	"HWC_Yoshino_Com_", 16) == 0)
+	{
+	((uint8_t *)rb)[0x30] = 1;
+	// 0=not_allowed, 1=locked, 2=unlocked,
+	// 3=allowed_when_sl_is_unlocked,
+	// 4=allowed_since_sl_is_unlocked,
+	// 5=unsupported_bl_status->generic error
+	// (no info in security test screen "none")
+	printk(KERN_INFO "myQSEE: patched unlock status to %d\n", ((uint8_t *)rb)[0x30]);
+	}
+	}
+	} else {
+	if (rb[0] != 0) {
+	printk(KERN_INFO "myQSEE: patched returned code 0x%08x (%d) to 0\n", rb[0], (int32_t)rb[0]);
+	rb[0] = 0;
+	((uint8_t *)rb)[0x08] = 2;
+	printk(KERN_INFO "myQSEE: patched unlock status [0x08] to %d\n", ((uint8_t *)rb)[0x08]);
+	((uint8_t *)rb)[0x0c] = 1;
+	printk(KERN_INFO "myQSEE: patched secure status [0x0c] to %d\n", ((uint8_t *)rb)[0x0c]);
+	}
+	}
+
return ret;
}

we can simulate the expected returned response from qseecom driver (tz) to get rooting status and security a meaningful value:

$ adb shell
~ # cat /proc/version
Linux version 4.4.78-perf+ (BuildUser@BuildHost) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #15 SMP PREEMPT Sun Oct 13 18:55:43 CEST 2019
~ # exit

$ fastboot getvar all
(bootloader) version:0.4-SONY-0.31
(bootloader) max-download-size:104857600
(bootloader) Version-sony:0.31
(bootloader) Loader-version:XFL-MSM8998-N-47
(bootloader) serialno:BH900xxxxx
(bootloader) version-bootloader:1306-5035_X_Boot_MSM8998_LA2.0_P_114
(bootloader) version-baseband:1307-7511_47.2.A.10.107
(bootloader) product:G8441
(bootloader) Phone-id:0000:xxxxxxxxxxxx
[B](bootloader) Rooting-status:ROOTED[/B]
(bootloader) Device-id:xxxxxxxx
(bootloader) Platform-id:2005E0E1
(bootloader) Frp-partition:frp
[B](bootloader) secure:no[/B]
(bootloader) Sector-size:4096
(bootloader) Ufs-info:SKhynix,H28U62301AMR,D003
(bootloader) Keystore-counter:16777216
(bootloader) Sake-root:D159
(bootloader) Default-security:eek:N
(bootloader) S1-root:S1_Root_e69c
(bootloader) Security-state:<empty>
(bootloader) USB-version:0x0200
(bootloader) slot-count:0
(bootloader) slot-suffixes:<empty>
(bootloader) current-slot:<empty>
all:
finished. total time: 0.116s

We also get different log from the loader - different errors now:

$ adb shell
~ # cat /log.log
INIT: Sat Feb 13 09:20:37 1971
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ keystore.c:394]:
keystore check failed
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ ks_util.c:87]:
Failed to load keystore
[ERROR @ authenticate.c:802]:
ksutil_keystore_init failed -1007
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ keystore.c:394]:
keystore check failed
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ ks_util.c:87]:
Failed to load keystore
[ERROR @ authenticate.c:589]:
No valid keystore present
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ keystore.c:394]:
keystore check failed
[ERROR @ keystore.c:319]:
Invalid counter rpmb: 16777216, cms: 1
[ERROR @ ks_util.c:87]:
Failed to load keystore
[ERROR @ fastboot.c:2445]:
keystore init failed: (-1007)
[ERROR @ fastboot.c:3315]:
get_value failed for Security-state
[ERROR @ fastboot.c:3315]:
get_value failed for slot-suffixes
[ERROR @ fastboot.c:3315]:
get_value failed for current-slot
~ #

logcat:

02-13 09:19:33.249 1 1 I init : type=1400 audit(0.0:437): avc: denied { mounton } for path="/dev/usb-ffs/adb" dev="functionfs" ino=2089 scontext=u:r:kernel:s0 tcontext=u:object_r:functionfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:438): avc: denied { read write } for name="sda1" dev="tmpfs" ino=16523 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:439): avc: denied { open } for path="/dev/block/sda1" dev="tmpfs" ino=16523 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:440): avc: denied { dac_override } for capability=1 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:441): avc: denied { read write } for name="ep0" dev="functionfs" ino=789 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:442): avc: denied { open } for path="/dev/fs/ep0" dev="functionfs" ino=789 scontext=u:r:shell:s0 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:443): avc: denied { connectto } for path="/dev/socket/property_service" scontext=u:r:shell:s0 tcontext=u:r:kernel:s0 tclass=unix_stream_socket permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:444): avc: denied { read } for name="present" dev="sysfs" ino=38142 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:445): avc: denied { open } for path="/sys/devices/soc/800f000.qcom,spmi/spmi-0/spmi0-02/800f000.qcom,spmi:qcom,pmi8998@2:qcom,qpnp-smb2/power_supply/usb/present" dev="sysfs" ino=38142 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:446): avc: denied { write } for name="charging_enabled" dev="sysfs" ino=38255 scontext=u:r:shell:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.259 1 1 I init : type=1400 audit(0.0:447): avc: denied { remove_name } for name="f1" dev="configfs" ino=2115 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=1 ppid=0 pcomm="swapper/0"
02-13 09:19:33.259 1 1 I init : type=1400 audit(0.0:448): avc: denied { unlink } for name="f1" dev="configfs" ino=2115 scontext=u:r:kernel:s0 tcontext=u:object_r:configfs:s0 tclass=lnk_file permissive=1 ppid=0 pcomm="swapper/0"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:449): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:450): avc: denied { bind } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.259 699 699 I loader : type=1400 audit(0.0:451): avc: denied { read } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_kobject_uevent_socket permissive=1 ppid=1 pcomm="init" pgid=699 pgcomm="loader"
02-13 09:19:33.919 703 703 I loader : type=1400 audit(0.0:452): avc: denied { execute_no_trans } for path="/system/bin/toybox" dev="tmpfs" ino=9569 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 703 703 I tar : type=1400 audit(0.0:453): avc: denied { write } for name="firmware" dev="tmpfs" ino=9591 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 703 703 I tar : type=1400 audit(0.0:454): avc: denied { add_name } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 703 703 I tar : type=1400 audit(0.0:455): avc: denied { create } for name="tzloader.b00" scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 703 703 I tar : type=1400 audit(0.0:456): avc: denied { write } for path="/system/etc/firmware/tzloader.b00" dev="tmpfs" ino=37940 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 703 703 I tar : type=1400 audit(0.0:457): avc: denied { setattr } for name="tzloader.b00" dev="tmpfs" ino=37940 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=699 pcomm="loader" pgid=699 pgcomm="loader"
02-13 09:19:33.939 699 699 I loader : type=1400 audit(0.0:458): avc: denied { ioctl } for path="/dev/qseecom" dev="tmpfs" ino=39572 ioctlcmd=970a scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=chr_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:33.951 699 699 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x2000
02-13 09:19:33.951 699 699 D QSEECOMAPI: App is not loaded in QSEE
02-13 09:19:33.951 699 699 D QSEECOMAPI: app_arch = 1, total_files = 9
02-13 09:19:33.985 699 699 D QSEECOMAPI: Loaded image: APP id = 196611
02-13 09:19:35.179 665 665 I adbd : type=1400 audit(0.0:459): avc: denied { sendto } for path="/dev/socket/logdw" scontext=u:r:adbd:s0 tcontext=u:r:shell:s0 tclass=unix_dgram_socket permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:19:51.139 707 707 I sh : type=1400 audit(0.0:460): avc: denied { getattr } for path="/proc/version" dev="proc" ino=4026532113 scontext=u:r:adbd:s0 tcontext=u:object_r:proc_version:s0 tclass=file permissive=1 ppid=665 pcomm="adbd" pgid=665 pgcomm="adbd"
02-13 09:19:51.549 716 716 I cat : type=1400 audit(0.0:461): avc: denied { read } for name="version" dev="proc" ino=4026532113 scontext=u:r:adbd:s0 tcontext=u:object_r:proc_version:s0 tclass=file permissive=1 ppid=707 pcomm="sh" pgid=707 pgcomm="sh"
02-13 09:19:58.059 718 718 I ps : type=1400 audit(0.0:463): avc: denied { getattr } for path="/proc/690" dev="proc" ino=2124 scontext=u:r:adbd:s0 tcontext=u:r:shell:s0 tclass=dir permissive=1 ppid=707 pcomm="sh" pgid=707 pgcomm="sh"
02-13 09:20:22.439 725 725 I dmesg : type=1400 audit(0.0:467): avc: denied { syslog_read } for scontext=u:r:adbd:s0 tcontext=u:r:kernel:s0 tclass=system permissive=1 ppid=722 pcomm="sh" pgid=722 pgcomm="sh"
02-13 09:20:37.119 699 699 I loader : type=1400 audit(0.0:468): avc: denied { sys_rawio } for capability=17 scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=capability permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:20:37.152 699 699 D QSEECOMAPI: QSEECom_get_handle sb_length = 0x1000
02-13 09:20:37.152 699 699 D QSEECOMAPI: App is already loaded QSEE and app id = 131074
02-13 09:20:37.139 699 699 I loader : type=1400 audit(0.0:469): avc: denied { ioctl } for path="/dev/block/sda" dev="tmpfs" ino=16518 ioctlcmd=1268 scontext=u:r:shell:s0 tcontext=u:object_r:tmpfs:s0 tclass=blk_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:20:37.159 699 699 I loader : type=1400 audit(0.0:470): avc: denied { append } for path="/log.log" dev="tmpfs" ino=40961 scontext=u:r:shell:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"
02-13 09:20:37.179 699 699 I loader : type=1400 audit(0.0:472): avc: denied { read write } for name="bcdUSB" dev="configfs" ino=40962 scontext=u:r:shell:s0 tcontext=u:object_r:configfs:s0 tclass=file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"

And here is the kernel logging the qseecom requests with responses, as implemented in the patch:

[ 764.536465] myQSEE: app=tzxflattest
[ 764.536484] myQSEE req: 00000000: 07 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
[ 764.536495] myQSEE req: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536506] myQSEE req: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536516] myQSEE req: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536526] myQSEE rsp: 00000000: 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536536] myQSEE rsp: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536546] myQSEE rsp: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.536556] myQSEE rsp: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537187] myQSEE REQ: 00000000: 07 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
[ 764.537198] myQSEE REQ: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537209] myQSEE REQ: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537219] myQSEE REQ: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537229] myQSEE RSP: << 00000000: fd ff ff ff 05 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537239] myQSEE RSP: << 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537248] myQSEE RSP: << 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537258] myQSEE RSP: << 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 764.537261] myQSEE: patched returned code 0xfffffffd (-3) to 0
[ 764.537263] myQSEE: patched unlock status [0x08] to 2
[ 764.537265] myQSEE: patched secure status [0x0c] to 1

Full dmesg attached, the same req/resp appears multiple times.

Clearly the response is errorneous while the loader is running in normal boot mode instead of sony service (flash) mode.