From PINE64
Revision as of 09:24, 16 September 2020 by Biktorgj (talk | contribs) (Created page with "= Modems used in Pine64 boards and devices = == Quectel EG25-G Modem == * Specifications:")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Modems used in Pine64 boards and devices

Quectel EG25-G Modem


  • Processor Family: Qualcomm MDM9607
  • CPU: Qualcomm MDM9207
  • Cores: 1 ACPU Core, Qualcomm Hexagon DSP
  • Total RAM: 256Mb
  • Total flash space: 256Mb
  • Available RAM for the ACPU: 160Mb

NAND Partition table layout

  • MTD0: SBL (Secondary Bootloader), called from the BootROM. Used to start the TrustZone kernel and the Application Bootloader (LK). Also used to enter Quectel's recovery mode
  • MTD1: mibib (Unknown, used by the DSP)
  • MTD2: EFS2 (Unexplored, probably NVRAM data, Used by the DSP)
  • MTD3: sys_rev: Unexplored
  • MTD4: rawdata: Unexplored
  • MTD5: tz: TrustZone kernel
  • MTD6: rpm: Resource / Power Manager
  • MTD7: cust_info: Unexplored
  • MTD8: aboot: Application Bootloader. Uses LK (LittleKernel) as the bootloader. By default it allows flashing unsigned images but won't allow booting them, soft-bricking the modem until you enter EDL mode
  • MTD9: boot: OpenEmbedded boot kernel + DTB
  • MTD10: recovery: Recovery kernel (normally unused)
  • MTD11: modem: ADSP firmware blobs
  • MTD12: misc: Unexplored
  • MTD13: recoveryfs: Recovery filesystem image (FOTA updates)
  • MTD14: usr_data: User data partition (/data when mounted by OpenEmbedded)
  • MTD15: sec (Used to blow fuses in the mdm9207 from images generated by Qualcomm Sectools)
  • MTD16: system (Linux OpenEmbedded root image, formatted in Ubifs filesystem)

Firmware Recovery

The System partition is mounted as readonly mode, but the data partition is writable. It might be possible, if there's an unexpected reset or power is lost while running, that the data partition gets corrupt and thus unable to boot.

The modem has 4 different boot modes:

  • Normal boot
  • Recovery mode (used by the modem usually to install a FOTA update)
  • Fastboot mode
  • Qualcomm EDL Mode

If the modem is unable to boot, depending on the type of crash, it might not show anywhere (USB device missing), it might malfunction (no radio but USB working), or it might enter EDL mode if the entire flash is corrupt

In any scenario, the modem can be triggered to enter EDL mode by shorting two test pins in the PinePhone Motherboard. Power off the phone, short the two test points and start it again while keeping the pads shorted at least until you hear the camera clicking twice (which is normally when the modem is powered) [PHOTO]

Download the Firmware Recovery Package and copy it to the Pinephone: To check if you're currently booted in EDL mode, run lsusb in a terminal and inspect the output. You should see the following device listed: Bus 003 Device 003: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

Once in EDL mode, open a terminal and go to the root directory of the recovery package, and run:

If you use an ARM64 distro (most likely) ./qfirehose_arm64 -f ./

If you use an ARMHF (32 bit) distro: ./qfirehose_armhf -f ./

After it finishes, it will reboot the modem and after about 30 seconds it will get back up and running

Bootloader unlocking

The Modem has a locked bootloader. It won't allow to boot unsigned Kernel images, but will allow to flash them, making it easy to brick the modem. To fix this, you can flash an unlocked bootloader, which will then allow you to do as you please with the hardware.

The source code for the Bootloader is here: Prebuilt binary releases can be downloaded from here:

Custom Kernels and system images

Custom kernel builds and system images can be created for the modem, though they require a couple of things to be correctly built and be bootable. The source code release for the kernel provided by the manufacturer is incomplete and won't build, and common Android tools mkbootimg and dtbtool won't build a bootable image, even if the kernel is correctly compiled and all the DTB's attached. Further, there's no source for the OpenEmbedded parts, so building a new system image must be done from scratch, and retrieving the mandatory binary blobs to use the ADSP part of the modem.

There's a _Work in progress_ SDK to allow creating custom kernels and system images, which can be downloaded from the following repo:

Once downloaded, you should run the '' script, which will create all the base directories and download all the different repos required to build. After the initial setup is complete, run 'make' without arguments to list the available options