ODROID XU4 Boot Details - ku-sldg/stairCASE GitHub Wiki

The ODROID-XU4 boot sequence is detailed here, and more information can be found sprinkled across the ODROID forum. There are actually multiple different bootloaders floating around. ODROID have always had their official fork, but some community members have made modifications to serve specific needs needs. Most of these had to do with booting your image in ARM HYP mode. However, we shouldn't need to use anything other than the mainline XU4 bootloader, as it seems this version can boot into HYP mode as is (both linux and sel4 agree they boot in hyp mode). If for some reason you do need to use a modified bootloader, note that any of the XU3 bootloaders should work on the XU4.

Regardless of which version of the bootloader you use, they will all be comprised of the following blobs, listed here in order of execution and position on the boot medium:

bl1.bin

Also referred to as fwbl1, this is the first-stage bootloader. It is provided by Samsung as is, so we don't have many details. It is signed by Samsung, and encrypted. They really don't want you reverse engineering this :laughing:.

bl2.bin

This is the second-stage bootloader, aka the secondary program loader (SPL) or the MMC Loader (MLO). This is actually part of U-boot and can be extracted from your own personally compiled u-boot.bin using the mkexynosspl tool in the tools directory. However, it must be signed by the ODROID people (requests can be made on the ODROID forum) for the board to actually run it, so if you aren't making changes it would be much easier to just use the provided blob.

u-boot.bin

This is the U-boot image that we can build ourselves. It does not have to be signed, so we can make changes easily.

tzsw.bin

This is "TrustZone Software", provided by Samsung/ARM. It seems like this shouldn't be kept as opaque as bl1, but I haven't been able to dig up much information about it on the ODROID wiki and forum. According to the mods, you cannot boot without it (I can confirm, without tzsw.bin the fan will spin up but U-boot will not reach it's interactive menu), and it is signed by Samsung. It is not open source, but there is an open source attempt to reconstruct it (Technically this is for an older entry in the ODROID-XU series). The mods are willing to sign a modified tzsw.bin, but modifying it would be quite difficult for the aforementioned reasons.

This blob seems to pose a bit of a problem. It doesn't have any source or documentation, and it doesn't seem to conform to the standard interface. So why not scrap it and create our own TrustZone software for our own needs? Well, like I said earlier, the mods claim the provided blob is essential to the boot process.

Here is the most information I managed to find on it.