Hi Kevin,
How are you doing? Not spoken for years!
I presume you have some of these (along with all the other group buys from years gone by)?
Paul.
LOL. So, okay. The microphones seem to be working now.
TIL: The mute switch on the device is a physical hardware mute. In my pmOS build it is mapped as the Mic Mute key, so it mutes once you toggle it back and forth once, at this moment. That means that the software mute state of the mic doesnāt always match the physical state of the switch. But if the mute switch is in the mute position power to the mics is cut.
6 Likes
So Iāve got hold of an SD-8501F to potentially sacrifice in the name of testing 
I just hooked it up and tried to do āedl rl dumps --genxmlā while booting it with both volume buttons held and edl returns with;
Iām not super familiar with the edl program but it looks like it uses a loader for a given HWID from the āLoadersā folder - a quick look in the lenovo_motorola one doesnāt yield any file that has a matching id. Does this mean the SD-8501F canāt be flashed (or even backed up!) using the tool?
1 Like
Looks like an appropriate firehose loader might be available here (Lenovo Smart Display 8" & 10") (Amber & Blueberry) AVB/Bootloader Unlock, Firmware | XDA Forums
Another helpful XDA post from @deadman96385 
3 Likes
Legend, glad someone knows what they are doing
Itās now dumping the device, hopefully I will get time to try your PM build on it tonight but I might not get any chance till tomorrow.
1 Like
Iāve tried to flash PMOS to the SD 8" today but writing boot fails.
Looking at the flash dump I took there is no ābootā partition - it has a boot_a / boot_b.
I havenāt attempted to flash to either of those as Iām not sure if they need to match a given size or anything?
I have run edl printgpt on the SD 8" and get the following;
GPT Table:
-------------
persist: Offset 0x0000000000005000, Length 0x0000000000800000, Flags 0x0000000000000001, UUID 0dab8208-c50a-4904-4e90-f3fa09fb0c97, Type 0x6c95e238, Active False
modem_a: Offset 0x0000000000805000, Length 0x0000000002000000, Flags 0x007b000000000000, UUID b2cb8543-9638-466b-25b5-d04c7a1245e1, Type EFI_BASIC_DATA, Active False
modem_b: Offset 0x0000000002805000, Length 0x0000000002000000, Flags 0x007f000000000000, UUID f6ccdbd6-82ea-429e-8282-157b07123ba1, Type EFI_BASIC_DATA, Active True
drm_a: Offset 0x0000000004805000, Length 0x0000000000400000, Flags 0x0000000000000000, UUID f5ddef53-8212-4420-3bac-5aa1e519dc85, Type 0x69a2c22e, Active False
drm_b: Offset 0x0000000004c05000, Length 0x0000000000400000, Flags 0x0004000000000000, UUID a7e57bb2-ff5c-4fc5-60a9-369bf6e32238, Type 0x69a2c22e, Active True
bluetooth_a: Offset 0x0000000005005000, Length 0x0000000000080000, Flags 0x007b000000000000, UUID e6002677-8b72-47fe-4f92-0c20ab630954, Type 0xb8f5e193, Active False
bluetooth_b: Offset 0x0000000005085000, Length 0x0000000000080000, Flags 0x007f000000000000, UUID d9ae9111-df3d-4162-d9a0-f28f395b130d, Type 0xb8f5e193, Active True
sbl1_a: Offset 0x0000000005105000, Length 0x0000000000080000, Flags 0x007b000000000000, UUID fdaf0512-266f-4b6e-c29b-43cc48477862, Type 0x8ffb455f, Active False
sbl1_b: Offset 0x0000000005185000, Length 0x0000000000080000, Flags 0x007f000000000000, UUID c22cac86-0b2e-4245-089a-954ef22282d8, Type 0xdea0ba2c, Active True
aboot_a: Offset 0x0000000005205000, Length 0x0000000000100000, Flags 0x007b000000000000, UUID a97f732f-4ec2-4422-b1a6-29a4dc08295b, Type 0x8ffb455f, Active False
aboot_b: Offset 0x0000000005305000, Length 0x0000000000100000, Flags 0x007f000000000000, UUID e2f5a6ef-339d-4e61-338c-c5ca002096c5, Type 0x400ffdcd, Active True
rpm_a: Offset 0x0000000005405000, Length 0x0000000000080000, Flags 0x007b000000000000, UUID 743b75f2-648b-4b4d-309a-1ad891464c81, Type 0x8ffb455f, Active False
rpm_b: Offset 0x0000000005485000, Length 0x0000000000080000, Flags 0x007f000000000000, UUID 1d8adb63-b579-41a0-d3a7-6bcbe4d05e21, Type 0x98df793, Active True
tz_a: Offset 0x0000000005505000, Length 0x0000000000200000, Flags 0x007b000000000000, UUID e36ef649-73d2-4bdf-77a3-52de296992f5, Type 0x8ffb455f, Active False
tz_b: Offset 0x0000000005705000, Length 0x0000000000200000, Flags 0x007f000000000000, UUID 17d0d0d6-cb6c-4af9-879f-cd5ae2dc1c2e, Type 0xa053aa7f, Active True
devcfg_a: Offset 0x0000000005905000, Length 0x0000000000040000, Flags 0x007b000000000000, UUID 1a5b199a-5a01-4f1f-ed8b-3ca0dca152bf, Type 0xf65d4b16, Active False
devcfg_b: Offset 0x0000000005945000, Length 0x0000000000040000, Flags 0x007f000000000000, UUID fab15296-82a9-4d68-ceb0-d7607601c585, Type 0xf65d4b16, Active True
modemst1: Offset 0x0000000005985000, Length 0x0000000000180000, Flags 0x0000000000000000, UUID 482356c9-1188-4044-168a-b7b69d6e5caa, Type 0xebbeadaf, Active False
modemst2: Offset 0x0000000005b05000, Length 0x0000000000180000, Flags 0x0000000000000000, UUID f9a9055e-ee53-423e-4195-a2976447539b, Type 0xa288b1f, Active False
misc: Offset 0x0000000005c85000, Length 0x0000000000100000, Flags 0x0000000000000000, UUID 6956ac92-3b1f-47f9-6188-8fde4ee88149, Type 0x82acc91f, Active False
fsc: Offset 0x0000000005d85000, Length 0x0000000000000400, Flags 0x0000000000000000, UUID 07d39049-0428-42d6-379a-6db94eb0a96d, Type 0x57b90a16, Active False
ssd: Offset 0x0000000005d86000, Length 0x0000000000002000, Flags 0x0000000000000000, UUID 61dfe6d4-3c6e-4668-ff88-ac586e76631d, Type 0x2c86e742, Active False
DDR: Offset 0x0000000005d88000, Length 0x0000000000008000, Flags 0x0000000000000000, UUID 86faafe9-1149-4acb-159c-1408e7ca1187, Type 0x20a0c19c, Active False
fsg: Offset 0x0000000005d90000, Length 0x0000000000180000, Flags 0x0000000000000000, UUID 4626d341-5a94-47e6-e2ac-2cae24dcf425, Type 0x638ff8e2, Active False
sec: Offset 0x0000000005f10000, Length 0x0000000000004000, Flags 0x0000000000000000, UUID a547ce56-04b9-4386-bba2-06a8c3350052, Type 0x303e6ac3, Active False
boot_a: Offset 0x0000000005f14000, Length 0x0000000002000000, Flags 0x0073000000000000, UUID 73611417-efe7-4b57-d29c-38097bb50c88, Type 0xbb499290, Active False
boot_b: Offset 0x0000000007f14000, Length 0x0000000002000000, Flags 0x0077000000000000, UUID 40f1123d-264c-40f8-d0b2-5e0439b2a5be, Type 0xbb499290, Active True
system_a: Offset 0x0000000009f14000, Length 0x0000000020000000, Flags 0x007b000000000000, UUID f89ea27f-335d-4e28-a0b2-93ac241e2a9a, Type 0xf2778c4, Active False
system_b: Offset 0x0000000029f14000, Length 0x0000000020000000, Flags 0x007f000000000000, UUID a06ddaad-ce4e-4ba7-438f-bd58531e6871, Type 0xf2778c4, Active True
vbmeta_a: Offset 0x0000000049f14000, Length 0x0000000000010000, Flags 0x007b000000000000, UUID ad2de158-d327-4978-66b7-07d258b66855, Type 0xb598858a, Active False
vbmeta_b: Offset 0x0000000049f24000, Length 0x0000000000010000, Flags 0x007f000000000000, UUID 1bb36ef4-9fd6-49df-8b91-ad25ed54ff5f, Type 0xb598858a, Active True
vendor_a: Offset 0x0000000049f34000, Length 0x0000000008000000, Flags 0x007b000000000000, UUID 5f2d00cc-5041-48ad-13a6-7ee6e88ddb5a, Type 0x314f99d5, Active False
vendor_b: Offset 0x0000000051f34000, Length 0x0000000008000000, Flags 0x007f000000000000, UUID 51cd5036-4c23-4b68-4fb4-b517103a9de6, Type 0x314f99d5, Active True
oem_bootloader_a: Offset 0x0000000059f34000, Length 0x0000000000400000, Flags 0x0000000000000000, UUID 5c7b5ca2-e044-43e4-e7b7-f46163d3e973, Type 0xaa3434b2, Active False
oem_bootloader_b: Offset 0x000000005a334000, Length 0x0000000000400000, Flags 0x0000000000000000, UUID 8b71619e-d9f3-4e61-6287-dbe37850dcd5, Type 0xaa3434b2, Active False
factory: Offset 0x000000005a734000, Length 0x0000000002000000, Flags 0x0000000000000000, UUID bdc4fe0c-5805-4c4f-34a2-dc127eb9056d, Type 0xaa3434b2, Active False
factory_bootloader: Offset 0x000000005c734000, Length 0x0000000001000000, Flags 0x0000000000000000, UUID 6ce826f4-89eb-467a-9ca9-f823b262607b, Type 0xaa3434b2, Active False
devinfo: Offset 0x000000005d734000, Length 0x0000000000100000, Flags 0x0000000000000000, UUID cc409fb0-fc1f-476c-f88a-44ace5332938, Type 0x1b81e7e6, Active False
keystore: Offset 0x000000005d834000, Length 0x0000000000080000, Flags 0x0000000000000000, UUID beb9f190-6f59-4503-9988-6c4811ce5544, Type 0xde7d4029, Active False
config: Offset 0x000000005d8b4000, Length 0x0000000000080000, Flags 0x0000000000000000, UUID 686bfc53-6a21-4c4a-29a9-757c1e05b9ab, Type 0x91b72d4d, Active False
cmnlib_a: Offset 0x000000005d934000, Length 0x0000000000100000, Flags 0x007b000000000000, UUID c3f9561c-22b2-429a-7996-b4a647d92d61, Type 0x5d0549a1, Active False
cmnlib_b: Offset 0x000000005da34000, Length 0x0000000000100000, Flags 0x007f000000000000, UUID 6ec6067c-cf86-40ef-3aa3-4b7f460d8df6, Type 0x5d0549a1, Active True
dsp_a: Offset 0x000000005db34000, Length 0x0000000001000000, Flags 0x007b000000000000, UUID 1569463b-7f73-4c37-7585-e82ac9e13f50, Type EFI_BASIC_DATA, Active False
dsp_b: Offset 0x000000005eb34000, Length 0x0000000001000000, Flags 0x007f000000000000, UUID 5ddfef0b-255b-48b0-5e93-f235f0773307, Type EFI_BASIC_DATA, Active True
limits: Offset 0x000000005fb34000, Length 0x0000000000008000, Flags 0x0000000000000000, UUID f281dd08-8520-47e8-b7a8-a7e27ee8cd8c, Type 0x10a0c19c, Active False
dip: Offset 0x000000005fb3c000, Length 0x0000000000100000, Flags 0x0000000000000000, UUID 01b64dd4-268d-4d83-2798-2ec514d3d77d, Type 0x4114b077, Active False
syscfg: Offset 0x000000005fc3c000, Length 0x0000000000080000, Flags 0x0000000000000000, UUID 7702bd19-516f-46aa-5f82-bfb02655bfdf, Type 0x98df793, Active False
mcfg: Offset 0x000000005fcbc000, Length 0x0000000000400000, Flags 0x0000000000000000, UUID a40b5a76-2372-49ac-1d86-60523744129d, Type EFI_BASIC_DATA, Active False
keymaster_a: Offset 0x00000000600bc000, Length 0x0000000000100000, Flags 0x007b000000000000, UUID 4ead13cc-7d78-4d00-409f-94f07652bf39, Type 0x8ffb455f, Active False
keymaster_b: Offset 0x00000000601bc000, Length 0x0000000000100000, Flags 0x007f000000000000, UUID 52199540-2b34-4153-2289-6d9e2e3dd6c1, Type 0xf96cdfec, Active True
apdp: Offset 0x00000000602bc000, Length 0x0000000000040000, Flags 0x0000000000000000, UUID 83fd6f84-85af-48a8-cc8b-cdb24015af55, Type 0xe6e98da2, Active False
msadp: Offset 0x00000000602fc000, Length 0x0000000000040000, Flags 0x0000000000000000, UUID c7dca94c-0230-4129-a6a2-1e52d22f3a04, Type 0xed9e8101, Active False
dpo: Offset 0x000000006033c000, Length 0x0000000000002000, Flags 0x0000000000000000, UUID 2daf9cb5-a61c-425a-c695-2b8e2fa0f918, Type 0x11406f35, Active False
oem_a: Offset 0x000000006033e000, Length 0x000000001f400000, Flags 0x007b000000000000, UUID 44e204df-c4ee-4693-a1a6-5abadfd57edb, Type 0xaa3434b2, Active False
oem_b: Offset 0x000000007f73e000, Length 0x000000001f400000, Flags 0x007f000000000000, UUID 396997aa-e398-48d5-71a1-081943b9c7c1, Type 0xaa3434b2, Active True
userdata: Offset 0x000000009eb3e000, Length 0x00000000434bd000, Flags 0x0000000000000000, UUID d3e5db00-14f1-4083-319e-fb8191c13215, Type 0xbb7e6ed, Active False
If you think its worth trying to flash to boot_a / boot_b Iām happy to give it a go - I guess worst can I can always re-flash using the dump I made?
Also, to double check - I am assuming there is no need to unlock the bootloader etc using the steps in the link you posted? - Iām not 100% sure if that is only needed when flashing via fastboot?
Your partition layout suggests that the device uses Android Verified Boot 2.0.
Unfortunately I have zero experience with that.
My understanding is that in that case the bootloader must be unlocked and verified boot turned off. I have no idea how it works exactly though and whether those steps are fully reversible by restoring a full flash dump.
Maybe @deadman96385 has more insights?
Thanks for the insight, hopefully there will be a way to get it going as they seem to be so closely related to the Thinksmart View it would be a shame not to be able to benefit from the great work you have been doing on PMOS.
Iāll try and do some reading up on the whole AVB thing but it doesnāt seem to be an easy thing to get your head around when coming at it as a noob 
Dump vbmeta, mod it, flash it back
ā¦ or just do it in a hex editor, looks like all it does is change some configuration flags at a particular offset
IIRC, the smart clocks are avb locked and fastboot was built without the ability to change the configuration flags. Maybe this is similar.
Thanks for the suggestion - just gave it a try and the tool says it disabled verification ok, so flashed the modded vbmeta_a / vbmeta_b to the device, followed by flashing lk2nd.img to boot_a / boot_b - all seemed ok so far (boot_a / boot_b flashed REALLY quick though)
However when trying to flash userdata with the lenovo-cd-18781y-rootfs.img I got; Error: lenovo-cd-18781y-rootfs.img has 4790272 sectors but partition only has 2205160.
Conceding defeat for the evening I figured Iāll flash back the original partitions, so flashed the dumped vbmeta_a/vbmeta_b and the original boot_a/boot_b partitions back (boot partitions taking notably longer to write that the lk2nd.img).
However it now doesnāt display anything when powered on, so I tried writing the entire dump back using edl wl dump --loader=amber_blueberry_prog_emmc_firehose_8953_ddr.bin which wrote a whole bunch of partitions but ended with Couldn't write partition. Either wrong memorytype given or no gpt partition
After a power cycle there is still zero on the screen when applying power, but EDL is still alive if I hold both volume buttonsā¦ not sure where to go with it now 
1 Like
That actually seems like good progress. It appears that the tool works.
Your device has the a/b partition scheme. So has a bunch of wasted space on emmc for the redundant rom.
I guess from here, youād either need to nuke some of the partitions to create space for the rootfs img or shrink it (if thatās even possible).
Iām sure @FelixKa will have some insight for us.
Edit: it just dawned on me that you may need to re-enable avb to boot.
Try flashing the original vbmeta back into your device, after flashing boot.img
Suggest checking out @deadman96385 's smart clock threads over on xda.
1 Like
Yeah I did wonder if itās possible to essentially apply the partition table for the Thinksmart View to this device, but to be honest Iām not sure how that all hooks in with the A/B boot stuff.
What puzzles me is why reflashing vbmeta and boot hasnāt allowed it to boot stock again, as surely at this point it should essentially be back to the initial starting point?
Anyway happy to try things out and see if we can get PMOS alive on this thing too 
Agree. @FelixKa has given a pretty big gift to our community in his work on this. Would be awesome to get as wide applicability as possible!
Probably missing some critical fastboot commandā¦
Did @deadman96385 post a rom for this unit on xda?
If so Download it and look at the flash scripts inside the archive.
2 Likes
So progressā¦ I have the device back and working on stock firmware again.
I did some checking and it was booting to fastboot (totally black screen).
After some digging I tried my luck with 'fastboot erase ddr' after your tip about checking the flash scripts from @deadman96385 - and hey presto after a power cycle I have life on the screen again and it boots back to the Google Home setup screen.
Not sure what the best thing to try next is? - I wonder if we could get a smaller userdata image to try and flash @FelixKa ?
If we can prove the thing boots PMOS ok, then it could be worth the effort to try and resize the partitions to get more space (if thatās even possible with this whole A/B setup!).
2 Likes
@FelixKa , first of all, thanks A LOT putting all the effort into this, greatly appreciate what you and @mattmon has accomplished on this device so far!
I tried flashing your 20240227 on a new device today (from Windows). According to EDL the flashing went just fine but powering off + on afterwards I simply end up with a black screen. Any great ideas what to try ?
3 Likes
I think trying to boot a minimal OS image is a great idea. I will try to get a minimal image built and uploaded soon, but I canāt promise anything yet as I will be busy with my high-school robotics teamās (I mentor for coding there) competition this weekend 
Did you flash both images? (to boot and userdata)? Does the device show up via USB in some way? Note that it may take about 30-40 seconds for it to fully boot into pmOS if it isnāt crashing and going into memdump mode (USB device ID 900e).
4 Likes
Yes, I believe so - ran
python edl w boot lk2nd.img
python edl w userdata lenovo-cd-18781y-rootfs.img
ā¦ flashing completing ok according to EDL.
Looks like it stays in EDL mode after powering off and on though (I can flash again without holding vol buttons).
Device Manager in Windows reports the following for the USB (which seems quite useless):
Windows has stopped this device because it has reported problems. (Code 43)
A request for the USB device descriptor failed.
Odd. Iāve never experienced that before. Itās either booting or going into memdump mode with device ID 900e.
Can you check which USB Device ID it shows up as (would have to be 9008 if it went back to EDL mode, not 900e)?
1 Like
Hmmā¦ this is where itās supposed to be listed in this crappy OS. Will try to hook it up to a mac instead and see if it shows differently.
@FelixKa and @deadman96385 are most deserving of the credit.
They are creating things that did not exist before.
All I did was hack apart a rom and put a little lipstick on it
2 Likes