Cannot flash Qualcomm with Stock Image (Lenovo Tab M10 TB-X605L LTE, Android 8 Oreo)

Question

Background

I’ve bought a brand new Lenovo Tab M10 TB-X605L LTE. It’s for my grandma, so that she can video-call her great-grandchildren during the Corona crises, and I learned that I require to have Android 8 Oreo on it, as Teamviewer Host has to run on it and start automatically (my grandma is almost 90 years and she can operate a toaster, but not a tablet). Unfortunately, I’ve upgraded to Android 9 Pie, which by design doesn’t support Teamviewer host.

Problem

I need to get back to Android 8 Oreo, but I almost bricked my Lenovo Tab M10 by trying to do so. I’ve already spent a few days and read/tried tons of instructions/suggestions/forum discussions, and I’m completely stuck. I would really enjoy some help or the decisive tip – and especially my grandmother would really enjoy seeing her four great-grandchildren after three weeks of quarantine.

Log files

indicate that the Qualcomm chip doesn't accept the download

LSMA: [LMSA_Recovery] Shell Resp: Status=status_flash_download_failed
QFIL: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

This works

• I managed to get a M10 TB-X605L stock ROM Android 8 Oreo: https://www.techswizz.com/lenovo-tab-tb-x605l-stock-rom-firmware-flash-file/
• XML files contained: rawprogram_unsparse.xml, patch0.xml, rawprogram0.xml.bak,
• I can reboot to fastflash mode (reboot and hold Volume-Down), and I can use ADB and Fastboot.
• I can install TWRP recovery mode (by flashing recovery.img) and start/use TWRP (reboot and hold Volume-Up+Down).
• I I’ve unlocked the bootloader.
• I have installed the Qualcomm_USB_Driver_v1.0 and the tablet gets a COM port (can be seen in Device Manager).

This doesn’t work

General

• I cannot boot in normal mode (device stops or constantly reboots when I try).
• I managed to install Magisk (in TWRP), but the devices still can’t boot in normal mode afterwards, so I cannot start Magisk.

Lenovo Moto Smart Assistant (LSMA)

• I can start it, download the stock image. When I try to flash the device, the progress bar jumps to 33% immediately, and after a few seconds a “FAIL” button appears without any further information. Fastboot
• I can flash boot.img and recovery.img, but system.img is splitted in system_1.img, system_2.img, etc., and when I connect these files with packsparseimg.exe, the resulting system.img seems to be invalid (devices doesn’t start).

QFIL

• I can see the devices on the COM Port. I can load rawprogram_unsparse.xml and patch0.xml.
• When the device comes online, I try to hit Download immediately, and I either get the following error:
• ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
• ERROR: function: sahara_main:924 Sahara protocol error
• ERROR: function: main:303 Uploading Image using Sahara protocol failed
• Download Fail:Sahara Fail:QSaharaServer Fail:Process fail
• or it says the device is not in EDL mode (which is easy to fix by booting in EDL mode from TWRP, but then the sahara error comes up).

QPST

• I can connect the phone via QPST Configuration (COM3, Q/QCPP-XXX (Sarah Download), USB)-
• When I open the “eMMC Software Download app”, I can open the Sahara XML file rawprogram_unsparse.xml – I hope, that’s the right one.
• When I “Load XML def…”, I don’t know which xml file to open:
• rawprogram_unsparse.xml and rawprogram0.xml.bak show an error “Document error on element type ‘raw program’ and name/value ‘true’”.
• Patch0.xml shows no error, but I think it’s the wrong file for “Load XML def”.
• Dowloading with “Patch0.xml” leads to an error “Timeout waiting for device” QcomDLoader.exe (1.3.2.0)
• I can load the stock image directory (by pressing the appropriate "Load" button), and set the settings (eMMC programmer: prog_emmc_firehose_8953_lite.mbn, Raw program: rawprogram_unsparse.xml, patch0: patch0.xml).
• When I press ‘Start’ the Step/Status “Sahara/Flashing” appears for 5 seconds, followed by messages “failed.

Any help or suggestion is highly appreciated.

Answer 1

Solution (for flashing Qualcomm based Android devices)

This seems to be an easy, fast and reproducable solution for flashing Qualcomm based Android devices (tablets, mobile phones), so it should not be limited to my device type. You should espacially read on if you have troubles with flashing an Qualcomm based Android device with tools like QcomDloader, QFIL, eMMC Software Download.

As I had troubles on Windows, so I switched to Linux, and it worked like a charm. The point is that Windows under certain circumstances seems to block some port communication.

tl;dr

Instead of Windows, use a Linux system with the Qualcomm USB flashing tool to flash your device.

Requirements

You will need

• a stock image from the manufacturer (or any other image you like) for your device; I've found mine here
• a Linux based system (eg. a Raspberry PI with Rasbian installed)
• Required Tool: ADB and Fastboot (download and installation instruction below)
• Required Tool: Qualcomm USB flashing tool for Linux by ndechesne, tonyMakkiel and ric96 (can be downloaded here)
• Recommended tool: TWRP
• your device, a free USB port and an appropriate USB cable (no special flashing cable required).

Furthermore, it could be possible that you have to be able to unlock your the bootloader if your device. I'm not sure about that, as I had unlocked my tablet before I found the working solution.

Step-by-step approach

Backup your device

Make a complete and reliable backup of your android device first.

Write down your serial number

My had device lost its serial number after flashing. I don't know if this has any further impact - I didn't recognize on. Maybe you should take a note of your serial number before flashing your device.

Unzip your image file

You need to unzip the image file. You should get many files, including

• a *.mbn file (mine was `prog_emmc_firehose_8953_ddr.mbn`)
• a *.xml file that contains information on how the image is the be assembled - mine was `rawprogram_unsparse.xml`)
• a *.xml file that contains information on how the image has to be patched - mine was `patch0.xml`)

All of this files have the suit the chip type of your Android device - I highly recommend not trying this with files that were compiled for other chips.

Preparation on your Linux device

I've setup up my Raspberry PI 3B+ from scratch with Raspbian.

Install ADB and Fastboot on it:
sudo apt-get install android-tools-adb android-tools-fastboot

Download Qualcomm USB flashing tool for Linux:
git clone https://git.linaro.org/landing-teams/working/qualcomm/qdl.git

Change to the new qdl directory
cd qdl

and compile the software:
make

Return to the previous directory:
cd ..

Stop the Modem Manager (I've found this in one instruction - didn't do anything as I hadn't had it installed)
sudo systemctl stop ModemManager

Get ready to reboot your device in EDL mode

Option 1: You can still access your Android system

Connect your Android devices to your Linux system using the USB cable.

Start your Android device normally. Enable the developer options:

• Open the Settings screen, scroll down to the bottom, and tap About phone or About tablet.
• Scroll down to the bottom of the About screen and find the Build number.
• Tap the Build number field seven times to enable Developer Options. Tap a few times and you'll see a toast notification with a countdown that reads "You are now X steps way from being a developer."
• When you're done, you'll see the message "You are now a developer!"
• Tap the Back button and you'll see the Developer options menu just above the "About Phone" section in Settings.
• To enable USB Debugging, you’ll need to jump into the Developer options menu, scroll down to the Debugging section, and enable the "USB Debugging" slider.
• Android will prompt you to allow USB debugging (unless you had already granted access for your Linux system before). Check "Always allow from this computer" and tab "OK".

Go back to your Linux system, and check to connection:
adb devices

If the daemon is not running, it will be started.

You should see your device as (single) entry in the device list. Otherwise check the device, the connection and the settings again.

Go on to Unlock bootloader below.

Option 2: You cannot access your Android system (almost bricked)

Android devices have key combinations that allow you to boot them in different modes. Please check on the internet how to boot your device in the EDL Mode (Emergency Download Mode). For my device it's

• press and hold `on off key` for about 20 seconds, release it
• press and hold `vol up key`
• press and hold `on off key` (still hold the `vol up key`)
• wait for a short vibration
• release the `vol up key` first
• release the 'on off key`

Be careful, it make a diffence whether an USB cable is connected or not. Connecting the USB cable can have the same effect as pressing the power key.

Getting into the right boot mode can really be a mess. That's why it's the easiest way to work with TWRP (Team Win Recovery Project).

To do so, download the latest version of TWRP. You need a the appropriate img file for your device (for my device: twrp_x605f.img).

Reboot your device in fastboot mode (as described by the manufacturer of your device). For my device it's

• press and hold `on off key` for about 20 seconds, release it
• press and hold `vol down key`
• press and hold `on off key` (still hold the `vol up key`)
• wait for a short vibration
• release the `vol up key` first
• release the 'on off key`

On success, the device will show 'fastboot mode' in the corner.

Connect your device with the USB cable and check the connection:
fastboot devices

You should see your device as (single) entry in the device list. Otherwise check the device, the connection and try to reboot in fastboot mode again.

Make sure your TWRP image file is in the current directory. Install it by typing
fastboot flash recovery <TWRP image file> (replace with the actual file name)

Reboot your device in recovery mode (as described by the manufacturer of your device). For my device it's

• press and hold `on off key` for about 20 seconds, release it
• press and hold `vol up+down keys`
• press and hold `on off key` (still hold the `vol up key`)
• wait for a short vibration
• release the `vol up+down keys` first
• release the `on off key`

On success, TWRP will start. OK, it took my two to three attempts to get there, but it helps a lot as you can reboot precisely in the mode you need from the TWRP Reboot menu.

• System boots to your system.
• Recovery boots back to TWRP (or your recovery menu).
• Bootloader boots to fastboot mode.
• EDL boots to EDL.

Unlock bootloader (not sure if this is required - you can try it and skip this)

Having done that, unlock your bootloader. To do so, boot your device in fastboot mode

• by using the key combination, see above OR
• by typing `adb reboot bootloader` (when the device is connected and the Android system is running or TWRP is running), see above

Type
fastboot flashing unlock
and
fastboot oem unlock-go

Flash your device

Reboot your device to the Android system or to TWRP.

Prepare the flashing command (in one line) and do not hit enter yet
./qdl --debug --storage emmc --include '<path to the unzipped firmware files>' '<path to the unzipped firmware files>/<mbn file>' '<path to the unzipped firmware files>/rawprogram_unsparse.xml' '<path to the unzipped firmware files>/patch0.xml'

For me, that was (in one line) and do not hit enter yet
./qdl --debug --storage emmc --include 'TB-X605L_USER_S000020_20180921_Q00020_ROW' 'TB-X605L_USER_S000020_20180921_Q00020_ROW/prog_emmc_firehose_8953_ddr.mbn' 'TB-X605L_USER_S000020_20180921_Q00020_ROW/rawprogram_unsparse.xml' '/TB-X605L_USER_S000020_20180921_Q00020_ROW/patch0.xml'

Open another command prompt, and prepare the reboot EDL command adb reboot edl

Now, enjoy the following:

1. Run the flashing command (as prepared above), it should stop with the message 'Waiting for EDL device'
2. Run the reboot command from the second command prompt (as prepared above).

Note that you can of course enter the EDL mode in any other way - but as some instructions say that you have only a couple of seconds to start EDL mode, before the flashing is aborted.

The --debug option obviously isn't necessary, but you see much more action, and the flashing takes about 10 to 20 minutes.

Enjoy your unbricked devices!

PS: The documentation of the solution took a lot of time, and I'm a beginner here. I'm pretty sure that the description and formatting could be improved. I'd find it helpful if you give me hints as comments on how I could improve the description of the answer (instead of possibly downvoting it). Thanks!