Forums - IPQ4019 software tools for USB recovery + eMMC image creation

3 posts / 0 new
Last post
IPQ4019 software tools for USB recovery + eMMC image creation
Join Date: 9 May 23
Posts: 3
Posted: Wed, 2023-05-31 13:21


I'm working with the 8Devices Habanero DVK (based on the Qualcomm IPQ4019). I'm trying to figure out how to access the USB recovery mode to write to the NOR flash and also how to generate a bootable MMC image. After registering on the Qualcomm website, I have access to quite a lot of resources, but I'm struggling to find the necessary documentation.

For example, I downloaded the ipq4019-ilq-6-1-1-1 package. This appears to include many files, including binaries that would be used to create the final images. However, I'm struggling to find documentation to explain how to use the various scripts in the archive. Specifically, I'm trying to figure out:

  1. How to create a bootable eMMC image
  2. How to flash the 32MB NOR chip via USB recovery.
  • Up0
  • Down0
Join Date: 9 May 23
Posts: 3
Posted: Fri, 2023-06-02 20:06

The previous message appears to be spam that has been generated by ChatGPT.

I would be grateful if anyone could point me to the necessary documentation.

  • Up0
  • Down0
Join Date: 9 May 23
Posts: 3
Posted: Sun, 2023-06-04 20:30

After digging through some documentation, I was able to find some information that described how to create an eMMC image. I'm still having trouble booting, but here are the steps I took so far:

The device normally boots from SPI NOR, however, during development an unbootable U-boot image was flashed which prevented the board from booting and the following message printed on the serial console:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1343 - bootable_media_detect_entry, Start
B -      1685 - bootable_media_detect_success, Start
B -      1700 - elf_loader_entry, Start
B -      5125 - auth_hash_seg_entry, Start
B -      7300 - auth_hash_seg_exit, Start
B -    586214 - elf_segs_hash_verify_entry, Start
B -    705345 - PBL, End
B -    705369 - SBL1, Start
B -    796346 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    797824 - boot_flash_init, Start
B -   3080867 - Boot error ocuured!. Error code: 302a
I want to try and recover the board by creating a bootable eMMC image that I can flash on to an SD card. I have downloaded QCA_Networking_2022.SPF.11.5.5 QCA OEM from Chipcode and extracted it. I then use the `` and `` scripts to create an eMMC image. This involves the following steps:
- The scripts use Python2, but on a modern Ubuntu system, Python2 is no longer supported as the default Python. To resolve this, I simply find all instances of the word `python` inside the scripts and replace them with `python2`.
- Inside `NHSS.QSDK.11.5.5/apss_proc/out/proprietary/QSDK-Base/meta-tools/ipq40xx` I have created a new directory called `in`.
- I then copy the contents of `BOOT.BF.3.1.1/boot_images/build/ms/bin/40xx/misc/tools/` to the `in` folder. This is so that the scripts can find the `bootconfig_tool`.
- I then run `` from the `meta-tools` directory using the following command line:
`python2 --arch ipq40xx --fltype emmc --gencdt --genpart --genbootconf`
- In preparation for the `` command, I have to copy a few files to the `in` directory:
    - In order to not include a kernel and rootfs image, I modified `ipq40xx/flash_partition/emmc-partition.xml` to remove the files defined in the `0:HLOS` and `rootfs` partitions.
    - `sbl1_emmc.bin` from `BOOT.BF.3.1.1/boot_images/build/ms/bin/40xx/emmc/`
    - `tz.mbn` from `TZ.BF.2.7/trustzone_images/build/ms/bin/MAZAANAA/`
    - I then copied the U-boot image provided by 8Devices (, renaming it to `openwrt-ipq40xx-u-boot-stripped.elf`. This a known working U-boot that I have successfully flashed to NOR and run previously.
- I then run the following: `python2 --arch ipq40xx --fltype emmc --gencdt --genpart --genbootconf`
- The `` script normally calls the `mkimage` binary that is included in the `meta-tools` directory. However, this relies on libssl1, which is not supported in modern Ubuntu systems. I replaced it with the `mkimage` binary that is generated when I build the u-boot provided by the manufacturer at ``.
- I then run the following command: `python2 --arch ipq40xx --fltype emmc --srcPath ./ --inImage ipq40xx/in --outImage ipq40xx/out`
This successfully generates a single uImage in the `ipq40xx/out` folder. I understand that this image can be written to the eMMC via a working U-boot and using the `flash.scr` script generated in `ipq40xx/in`. However, as I do not have a working board, I then attempted to flash the image manually as follows:
- I inserted a 4GB microSD into my computer. This is recognised as `/dev/sdd`. I then run the following commands:
- I write `gpt_main0.bin` to `/dev/sdd`: `dd if=gpt_backup0.bin of=/dev/sdd`
- I write `gpt_backup0.bin` to the sector defined in `flash.scr`: `dd if=gpt_backup0.bin of=/dev/sdd seek=7634911`
- I verify that the gpt has been flashed correctly by running `gdisk /dev/sdd` and printing out the partition table:
GPT fdisk (gdisk) version 1.0.8
Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present
Found valid GPT with protective MBR; using GPT.
Command (? for help): p
Disk /dev/sdd: 7716864 sectors, 3.7 GiB
Model: microSD RDR     
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Partition table holds up to 16 entries
Main partition table begins at sector 2 and ends at sector 5
First usable sector is 34, last usable sector is 7634910
Partitions will be aligned on 2-sector boundaries
Total free space is 4707261 sectors (2.2 GiB)
Number  Start (sector)    End (sector)  Size       Code  Name
   1              34            1057   512.0 KiB   A012  0:SBL1
   2            1058            2081   512.0 KiB   FFFF  0:BOOTCONFIG
   3            2082            3105   512.0 KiB   A016  0:QSEE
   4            3106            4129   512.0 KiB   FFFF  0:QSEE_1
   5            4130            4641   256.0 KiB   A01B  0:CDT
   6            4642            5153   256.0 KiB   FFFF  0:CDT_1
   7            5154            6177   512.0 KiB   FFFF  0:BOOTCONFIG1
   8            6178            6689   256.0 KiB   FFFF  0:APPSBLENV
   9            6690            8737   1024.0 KiB  A015  0:APPSBL
  10            8738           10785   1024.0 KiB  FFFF  0:APPSBL_1
  11           10786           11297   256.0 KiB   FFFF  0:ART
  12           11298           27681   8.0 MiB     FFFF  0:HLOS
  13           27682           44065   8.0 MiB     FFFF  0:HLOS_1
  14           44066          175137   64.0 MiB    FFFF  rootfs
  15          175138          306209   64.0 MiB    FFFF  rootfs_1
  16          306210         2927649   1.3 GiB     FFFF  rootfs_data
- `dd if=sbl1_emmc.mbn.padded of=/dev/sdd1`
- `dd if=bootconfig.bin of=/dev/sdd2`
- `dd if=tz.mbn.padded of=/dev/sdd3`
- `dd if=cdt-AP-DK01.1-C1_128M16.bin.padded of=/dev/sdd5`
- `dd if=bootconfig.bin of=/dev/sdd7`
- `dd if=openwrt-ipq40xx-u-boot-stripped.elf.padded of=/dev/sdd9`
- I then run `sync` and remove the SD card.
Unfortunately, after configuring the DIP switch on the board to boot from eMMC, no output is present on the serial console.
As a last attempt, instead of flashing the tz and cdt files generated by the scripts, I attempt to flash the contents of the QSEE and CDT partition from a working image I have of the device's NOR flash. Unfortunately, I also get no serial console output.
I would be grateful for your assistance in this issue.
  • Up0
  • Down0
or Register

Opinions expressed in the content posted here are the personal opinions of the original authors, and do not necessarily reflect those of Qualcomm Incorporated or its subsidiaries (“Qualcomm”). The content is provided for informational purposes only and is not meant to be an endorsement or representation by Qualcomm or any other party. This site may also provide links or references to non-Qualcomm sites and resources. Qualcomm makes no representations, warranties, or other commitments whatsoever about any non-Qualcomm sites or third-party resources that may be referenced, accessible from, or linked to this site.