How to build IPQ4018 firmware

@chunkeey Sorry, I have seen https://github.com/chunkeey/FritzBox-4040-UBOOT/releases and know there are no big different between Qualcomm IPQ40xx boards. So I try to select uboot in make menuconfig, and uboot-fritz4040.bin is generated. Then, I try to update it by following steps, but the device cannot boot anymore, haha! Any mistake in my update procedure ?
Thanks for your advice.

root:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00100000 00020000 "0:BOOTCONFIG"
mtd3: 00100000 00020000 "0:QSEE"
mtd4: 00100000 00020000 "0:QSEE_ALT"
mtd5: 00080000 00020000 "0:CDT"
mtd6: 00080000 00020000 "0:CDT_ALT"
mtd7: 00080000 00020000 "0:DDRPARAMS"
mtd8: 00080000 00020000 "0:APPSBLENV"
mtd9: 00200000 00020000 "0:APPSBL"
mtd10: 00200000 00020000 "0:APPSBL_ALT"
mtd11: 00080000 00020000 "0:ART"
mtd12: 04100000 00020000 "rootfs"
mtd13: 003a2000 0001f000 "kernel"
mtd14: 01113000 0001f000 "ubi_rootfs"
mtd15: 0292c000 0001f000 "rootfs_data"

root:/tmp/run# tftp -r uboot-fritz4040.bin -g 192.168.1.100
root:/tmp/run# mtd write ./uboot-fritz4040.bin /dev/mtd9
Unlocking /dev/mtd9 ...

Writing from ./uboot-fritz4040.bin to /dev/mtd9 ...     
root:/tmp/run# reboot
procd: - reboot -
[  780.995206] reboot: Restarti
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      2612 - bootable_media_detect_success, Start
B -      2626 - elf_loader_entry, Start
B -      4036 - auth_hash_seg_entry, Start
B -      6192 - auth_hash_seg_exit, Start
B -     73461 - elf_segs_hash_verify_entry, Start
B -    194340 - PBL, End
B -    194364 - SBL1, Start
B -    283029 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    284555 - boot_flash_init, Start
D -     84696 - boot_flash_init, Delta
B -    373301 - boot_config_data_table_init, Start
D -     13985 - boot_config_data_table_init, Delta - (419 Bytes)
B -    389984 - clock_init, Start
D -      7570 - clock_init, Delta
B -    400957 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    404444 - sbl1_ddr_set_params, Start
B -    409428 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    413919 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13142 - sbl1_ddr_set_params, Delta
B -    427200 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    497787 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    513311 - Image Load, Start
D -    140605 - QSEE Image Loaded, Delta - (262104 Bytes)
B -    654413 - Image Load, Start
D -      2115 - SEC Image Loaded, Delta - (2048 Bytes)
B -    664570 - Image Load, Start
B -    667157 - Boot error ocuured!. Error code: 3039