Cannot flash Qualcomm with Stock Image (Lenovo Tab M10 TB-X605L LTE, Android 8 Oreo)


Question

Background



I’ve bought a brand new Lenovo Tab M10 TB-X605L LTE. It’s for my grandma, so that she can video-call her great-grandchildren during the Corona crises, and I learned that I require to have Android 8 Oreo on it, as Teamviewer Host has to run on it and start automatically (my grandma is almost 90 years and she can operate a toaster, but not a tablet). Unfortunately, I’ve upgraded to Android 9 Pie, which by design doesn’t support Teamviewer host.



Problem



I need to get back to Android 8 Oreo, but I almost bricked my Lenovo Tab M10 by trying to do so. I’ve already spent a few days and read/tried tons of instructions/suggestions/forum discussions, and I’m completely stuck. I would really enjoy some help or the decisive tip – and especially my grandmother would really enjoy seeing her four great-grandchildren after three weeks of quarantine.



Log files



indicate that the Qualcomm chip doesn't accept the download



LSMA: [LMSA_Recovery] Shell Resp: Status=status_flash_download_failed
QFIL: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.


This works




  • I managed to get a M10 TB-X605L stock ROM Android 8 Oreo: https://www.techswizz.com/lenovo-tab-tb-x605l-stock-rom-firmware-flash-file/

  • XML files contained: rawprogram_unsparse.xml, patch0.xml, rawprogram0.xml.bak,

  • I can reboot to fastflash mode (reboot and hold Volume-Down), and I can use ADB and Fastboot.

  • I can install TWRP recovery mode (by flashing recovery.img) and start/use TWRP (reboot and hold Volume-Up+Down).

  • I I’ve unlocked the bootloader.

  • I have installed the Qualcomm_USB_Driver_v1.0 and the tablet gets a COM port (can be seen in Device Manager).



This doesn’t work



General




  • I cannot boot in normal mode (device stops or constantly reboots when I try).

  • I managed to install Magisk (in TWRP), but the devices still can’t boot in normal mode afterwards, so I cannot start Magisk.



Lenovo Moto Smart Assistant (LSMA)




  • I can start it, download the stock image. When I try to flash the device, the progress bar jumps to 33% immediately, and after a few seconds a “FAIL” button appears without any further information.
    Fastboot

  • I can flash boot.img and recovery.img, but system.img is splitted in system_1.img, system_2.img, etc., and when I connect these files with packsparseimg.exe, the resulting system.img seems to be invalid (devices doesn’t start).



QFIL




  • I can see the devices on the COM Port. I can load rawprogram_unsparse.xml and patch0.xml.

  • When the device comes online, I try to hit Download immediately, and I either get the following error:

  • ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

  • ERROR: function: sahara_main:924 Sahara protocol error

  • ERROR: function: main:303 Uploading Image using Sahara protocol failed

  • Download Fail:Sahara Fail:QSaharaServer Fail:Process fail

  • or it says the device is not in EDL mode (which is easy to fix by booting in EDL mode from TWRP, but then the sahara error comes up).



QPST




  • I can connect the phone via QPST Configuration (COM3, Q/QCPP-XXX (Sarah Download), USB)-

  • When I open the “eMMC Software Download app”, I can open the Sahara XML file rawprogram_unsparse.xml – I hope, that’s the right one.

  • When I “Load XML def…”, I don’t know which xml file to open:

  • rawprogram_unsparse.xml and rawprogram0.xml.bak show an error “Document error on element type ‘raw program’ and name/value ‘true’”.

  • Patch0.xml shows no error, but I think it’s the wrong file for “Load XML def”.

  • Dowloading with “Patch0.xml” leads to an error “Timeout waiting for device”
    QcomDLoader.exe (1.3.2.0)

  • I can load the stock image directory (by pressing the appropriate "Load" button), and set the settings (eMMC programmer: prog_emmc_firehose_8953_lite.mbn, Raw program: rawprogram_unsparse.xml, patch0: patch0.xml).

  • When I press ‘Start’ the Step/Status “Sahara/Flashing” appears for 5 seconds, followed by messages “failed.



Any help or suggestion is highly appreciated.


Answer

Solution (for flashing Qualcomm based Android devices)


This seems to be an easy, fast and reproducable solution for flashing Qualcomm based Android devices (tablets, mobile phones), so it should not be limited to my device type. You should espacially read on if you have troubles with flashing an Qualcomm based Android device with tools like QcomDloader, QFIL, eMMC Software Download.


As I had troubles on Windows, so I switched to Linux, and it worked like a charm. The point is that Windows under certain circumstances seems to block some port communication.


tl;dr


Instead of Windows, use a Linux system with the Qualcomm USB flashing tool to flash your device.


Requirements


You will need



  • a stock image from the manufacturer (or any other image you like) for your device; I've found mine here

  • a Linux based system (eg. a Raspberry PI with Rasbian installed)

  • Required Tool: ADB and Fastboot (download and installation instruction below)

  • Required Tool: Qualcomm USB flashing tool for Linux by ndechesne, tonyMakkiel and ric96 (can be downloaded here)

  • Recommended tool: TWRP

  • your device, a free USB port and an appropriate USB cable (no special flashing cable required).


Furthermore, it could be possible that you have to be able to unlock your the bootloader if your device. I'm not sure about that, as I had unlocked my tablet before I found the working solution.


Step-by-step approach


Backup your device


Make a complete and reliable backup of your android device first.


Write down your serial number


My had device lost its serial number after flashing. I don't know if this has any further impact - I didn't recognize on. Maybe you should take a note of your serial number before flashing your device.


Unzip your image file


You need to unzip the image file. You should get many files, including



  • a *.mbn file (mine was `prog_emmc_firehose_8953_ddr.mbn`)

  • a *.xml file that contains information on how the image is the be assembled - mine was `rawprogram_unsparse.xml`)

  • a *.xml file that contains information on how the image has to be patched - mine was `patch0.xml`)


All of this files have the suit the chip type of your Android device - I highly recommend not trying this with files that were compiled for other chips.

Preparation on your Linux device


I've setup up my Raspberry PI 3B+ from scratch with Raspbian.


Install ADB and Fastboot on it:

sudo apt-get install android-tools-adb android-tools-fastboot


Download Qualcomm USB flashing tool for Linux:

git clone https://git.linaro.org/landing-teams/working/qualcomm/qdl.git


Change to the new qdl directory

cd qdl


and compile the software:

make


Return to the previous directory:

cd ..


Stop the Modem Manager (I've found this in one instruction - didn't do anything as I hadn't had it installed)

sudo systemctl stop ModemManager


Get ready to reboot your device in EDL mode


Option 1: You can still access your Android system


Connect your Android devices to your Linux system using the USB cable.


Start your Android device normally. Enable the developer options:



  • Open the Settings screen, scroll down to the bottom, and tap About phone or About tablet.

  • Scroll down to the bottom of the About screen and find the Build number.

  • Tap the Build number field seven times to enable Developer Options. Tap a few times and you'll see a toast notification with a countdown that reads "You are now X steps way from being a developer."

  • When you're done, you'll see the message "You are now a developer!"
  • Tap the Back button and you'll see the Developer options menu just above the "About Phone" section in Settings.

  • To enable USB Debugging, you’ll need to jump into the Developer options menu, scroll down to the Debugging section, and enable the "USB Debugging" slider.

  • Android will prompt you to allow USB debugging (unless you had already granted access for your Linux system before). Check "Always allow from this computer" and tab "OK".


Go back to your Linux system, and check to connection:

adb devices


If the daemon is not running, it will be started.


You should see your device as (single) entry in the device list. Otherwise check the device, the connection and the settings again.


Go on to Unlock bootloader below.


Option 2: You cannot access your Android system (almost bricked)


Android devices have key combinations that allow you to boot them in different modes. Please check on the internet how to boot your device in the EDL Mode (Emergency Download Mode). For my device it's



  • press and hold `on off key` for about 20 seconds, release it

  • press and hold `vol up key`

  • press and hold `on off key` (still hold the `vol up key`)

  • wait for a short vibration

  • release the `vol up key` first

  • release the 'on off key`


Be careful, it make a diffence whether an USB cable is connected or not. Connecting the USB cable can have the same effect as pressing the power key.


Getting into the right boot mode can really be a mess. That's why it's the easiest way to work with TWRP (Team Win Recovery Project).


To do so, download the latest version of TWRP. You need a the appropriate img file for your device (for my device: twrp_x605f.img).


Reboot your device in fastboot mode (as described by the manufacturer of your device). For my device it's



  • press and hold `on off key` for about 20 seconds, release it

  • press and hold `vol down key`

  • press and hold `on off key` (still hold the `vol up key`)

  • wait for a short vibration

  • release the `vol up key` first

  • release the 'on off key`


On success, the device will show 'fastboot mode' in the corner.


Connect your device with the USB cable and check the connection:

fastboot devices


You should see your device as (single) entry in the device list. Otherwise check the device, the connection and try to reboot in fastboot mode again.


Make sure your TWRP image file is in the current directory. Install it by typing

fastboot flash recovery <TWRP image file> (replace with the actual file name)


Reboot your device in recovery mode (as described by the manufacturer of your device). For my device it's



  • press and hold `on off key` for about 20 seconds, release it

  • press and hold `vol up+down keys`

  • press and hold `on off key` (still hold the `vol up key`)

  • wait for a short vibration

  • release the `vol up+down keys` first

  • release the `on off key`


On success, TWRP will start. OK, it took my two to three attempts to get there, but it helps a lot as you can reboot precisely in the mode you need from the TWRP Reboot menu.



  • System boots to your system.

  • Recovery boots back to TWRP (or your recovery menu).

  • Bootloader boots to fastboot mode.

  • EDL boots to EDL.


Unlock bootloader (not sure if this is required - you can try it and skip this)


Having done that, unlock your bootloader. To do so, boot your device in fastboot mode



  • by using the key combination, see above OR

  • by typing `adb reboot bootloader` (when the device is connected and the Android system is running or TWRP is running), see above


Type

fastboot flashing unlock

and

fastboot oem unlock-go


Flash your device


Reboot your device to the Android system or to TWRP.


Prepare the flashing command (in one line) and do not hit enter yet

./qdl --debug --storage emmc --include '<path to the unzipped firmware files>' '<path to the unzipped firmware files>/<mbn file>' '<path to the unzipped firmware files>/rawprogram_unsparse.xml' '<path to the unzipped firmware files>/patch0.xml'


For me, that was (in one line) and do not hit enter yet

./qdl --debug --storage emmc --include 'TB-X605L_USER_S000020_20180921_Q00020_ROW' 'TB-X605L_USER_S000020_20180921_Q00020_ROW/prog_emmc_firehose_8953_ddr.mbn' 'TB-X605L_USER_S000020_20180921_Q00020_ROW/rawprogram_unsparse.xml' '/TB-X605L_USER_S000020_20180921_Q00020_ROW/patch0.xml'


Open another command prompt, and prepare the reboot EDL command
adb reboot edl


Now, enjoy the following:



  1. Run the flashing command (as prepared above), it should stop with the message 'Waiting for EDL device'

  2. Run the reboot command from the second command prompt (as prepared above).


Note that you can of course enter the EDL mode in any other way - but as some instructions say that you have only a couple of seconds to start EDL mode, before the flashing is aborted.


The --debug option obviously isn't necessary, but you see much more action, and the flashing takes about 10 to 20 minutes.


Enjoy your unbricked devices!


PS: The documentation of the solution took a lot of time, and I'm a beginner here. I'm pretty sure that the description and formatting could be improved. I'd find it helpful if you give me hints as comments on how I could improve the description of the answer (instead of possibly downvoting it). Thanks!


Topics


2D Engines   3D Engines   9-Patch   Action Bars   Activities   ADB   Advertisements   Analytics   Animations   ANR   AOP   API   APK   APT   Architecture   Audio   Autocomplete   Background Processing   Backward Compatibility   Badges   Bar Codes   Benchmarking   Bitmaps   Bluetooth   Blur Effects   Bread Crumbs   BRMS   Browser Extensions   Build Systems   Bundles   Buttons   Caching   Camera   Canvas   Cards   Carousels   Changelog   Checkboxes   Cloud Storages   Color Analysis   Color Pickers   Colors   Comet/Push   Compass Sensors   Conferences   Content Providers   Continuous Integration   Crash Reports   Credit Cards   Credits   CSV   Curl/Flip   Data Binding   Data Generators   Data Structures   Database   Database Browsers   Date &   Debugging   Decompilers   Deep Links   Dependency Injections   Design   Design Patterns   Dex   Dialogs   Distributed Computing   Distribution Platforms   Download Managers   Drawables   Emoji   Emulators   EPUB   Equalizers &   Event Buses   Exception Handling   Face Recognition   Feedback &   File System   File/Directory   Fingerprint   Floating Action   Fonts   Forms   Fragments   FRP   FSM   Functional Programming   Gamepads   Games   Geocaching   Gestures   GIF   Glow Pad   Gradle Plugins   Graphics   Grid Views   Highlighting   HTML   HTTP Mocking   Icons   IDE   IDE Plugins   Image Croppers   Image Loaders   Image Pickers   Image Processing   Image Views   Instrumentation   Intents   Job Schedulers   JSON   Keyboard   Kotlin   Layouts   Library Demos   List View   List Views   Localization   Location   Lock Patterns   Logcat   Logging   Mails   Maps   Markdown   Mathematics   Maven Plugins   MBaaS   Media   Menus   Messaging   MIME   Mobile Web   Native Image   Navigation   NDK   Networking   NFC   NoSQL   Number Pickers   OAuth   Object Mocking   OCR Engines   OpenGL   ORM   Other Pickers   Parallax List   Parcelables   Particle Systems   Password Inputs   PDF   Permissions   Physics Engines   Platforms   Plugin Frameworks   Preferences   Progress Indicators   ProGuard   Properties   Protocol Buffer   Pull To   Purchases   Push/Pull   QR Codes   Quick Return   Radio Buttons   Range Bars   Ratings   Recycler Views   Resources   REST   Ripple Effects   RSS   Screenshots   Scripting   Scroll Views   SDK   Search Inputs   Security   Sensors   Services   Showcase Views   Signatures   Sliding Panels   Snackbars   SOAP   Social Networks   Spannable   Spinners   Splash Screens   SSH   Static Analysis   Status Bars   Styling   SVG   System   Tags   Task Managers   TDD &   Template Engines   Testing   Testing Tools   Text Formatting   Text Views   Text Watchers   Text-to   Toasts   Toolkits For   Tools   Tooltips   Trainings   TV   Twitter   Updaters   USB   User Stories   Utils   Validation   Video   View Adapters   View Pagers   Views   Watch Face   Wearable Data   Wearables   Weather   Web Tools   Web Views   WebRTC   WebSockets   Wheel Widgets   Wi-Fi   Widgets   Windows   Wizards   XML   XMPP   YAML   ZIP Codes