Fix lk2nd EDL transition on MSM8905 and auto-kick Fastboot into EDL

MANUAL.md

@@ -51,10 +51,10 @@ sudo ./flash-edl.sh
 The script will:
 1. Temporarily pause host `ModemManager` so it does not interfere with `05c6:9008`.
 2. Wait for the phone to appear in Qualcomm EDL mode (`05c6:9008`):
-   - **From Bananarchy Linux**: open the **Power** menu (`End / Power` key or `System menu -> Power`), select **Reboot to loader** (`sxmo_power.sh loader`) to enter the `lk2nd` Fastboot menu, and select **EDL** (or let `flash-edl.sh` automatically send `fastboot oem edl`).
+   - **From Bananarchy Linux**: open the **Power** menu (`End / Power` key or `System menu -> Power`), select **Reboot to loader** (`sxmo_power.sh loader`) to enter the `lk2nd` Fastboot menu, and select **EDL** (or let `flash-edl.sh` automatically send `fastboot oem reboot-edl`).
    - **Button combo**: power off the phone, hold **D-Pad up + D-Pad down**, and plug in the USB cable.
    - **EDL cable**: hold the EDL cable button while plugging in USB.
-   - **From ADB / Fastboot**: the script automatically sends `adb reboot edl` or `fastboot oem edl` if detected.
+   - **From ADB / Fastboot**: the script automatically sends `adb reboot edl` or `fastboot oem reboot-edl` if detected.
 3. Upload `bootloader/loaders/8110.mbn` via Sahara and connect to eMMC via Firehose.
 4. Back up `gpt.bin`, `fsc`, `fsg`, `modemst1`, `modemst2`, `persist`, and `boot` into `./backup/` (if not already backed up).
 5. Flash `lk2nd-msm8909.img` to `boot`, flash `images/bananarchy-<device>.img` to `userdata`, clear the stock `system` superblock, and reboot into Bananarchy Linux.

flash-edl.py

@@ -8,6 +8,7 @@ import sys
 import tempfile
 import time
 import usb.core
+import usb.util
 
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, os.path.join(BASE_DIR, "edl"))
@@ -27,6 +28,93 @@ DEVICE_LABELS = {
 }
 
 
+def _fb_read_status(ep_in, timeout_ms=5000):
+  while True:
+    resp = bytes(ep_in.read(64, timeout=timeout_ms))
+    if resp.startswith(b"INFO"):
+      continue
+    return resp
+
+
+def _fb_send_edl(fb_dev):
+  cfg = fb_dev.get_active_configuration()
+  intf = cfg[(0, 0)]
+  ep_out = usb.util.find_descriptor(
+    intf,
+    custom_match=lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_OUT,
+  )
+  ep_in = usb.util.find_descriptor(
+    intf,
+    custom_match=lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_IN,
+  )
+  if ep_out is None or ep_in is None:
+    return False
+  for cmd in (b"oem reboot-edl", b"oem edl"):
+    ep_out.write(cmd, timeout=1000)
+    try:
+      resp = _fb_read_status(ep_in, timeout_ms=1500)
+      if resp.startswith(b"OKAY"):
+        break
+    except Exception:
+      break
+  return True
+
+
+def _fb_upgrade_lk2nd_and_edl(fb_dev):
+  lk2nd_path = os.path.join(BASE_DIR, "bootloader", "lk2nd-msm8909.img")
+  if not os.path.isfile(lk2nd_path):
+    return
+  with open(lk2nd_path, "rb") as f:
+    lk2nd_data = f.read()
+
+  print("[*] Updating lk2nd on boot partition via Fastboot to enable EDL reboot...")
+  cfg = fb_dev.get_active_configuration()
+  intf = cfg[(0, 0)]
+  ep_out = usb.util.find_descriptor(
+    intf,
+    custom_match=lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_OUT,
+  )
+  ep_in = usb.util.find_descriptor(
+    intf,
+    custom_match=lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_IN,
+  )
+  if ep_out is None or ep_in is None:
+    return
+
+  ep_out.write(f"download:{len(lk2nd_data):08x}".encode("ascii"), timeout=2000)
+  resp = _fb_read_status(ep_in, timeout_ms=2000)
+  if not resp.startswith(b"DATA"):
+    return
+
+  chunk_sz = 16384
+  for off in range(0, len(lk2nd_data), chunk_sz):
+    ep_out.write(lk2nd_data[off:off + chunk_sz], timeout=5000)
+  if not _fb_read_status(ep_in, timeout_ms=5000).startswith(b"OKAY"):
+    return
+
+  ep_out.write(b"flash:boot", timeout=2000)
+  if not _fb_read_status(ep_in, timeout_ms=10000).startswith(b"OKAY"):
+    return
+
+  ep_out.write(b"reboot-bootloader", timeout=2000)
+  try:
+    _fb_read_status(ep_in, timeout_ms=2000)
+  except Exception:
+    pass
+  usb.util.dispose_resources(fb_dev)
+
+  time.sleep(2.0)
+  for _ in range(20):
+    new_fb = usb.core.find(idVendor=0x18D1, idProduct=0xD00D)
+    if new_fb is not None:
+      time.sleep(0.3)
+      _fb_send_edl(new_fb)
+      usb.util.dispose_resources(new_fb)
+      time.sleep(1.0)
+      return
+    time.sleep(0.5)
+
+
 def try_kick_into_edl():
   try:
     res = subprocess.run(
@@ -44,6 +132,21 @@ def try_kick_into_edl():
   except Exception:
     pass
 
+  # Direct USB Fastboot check (18d1:d00d) via pyusb so host fastboot CLI is optional
+  try:
+    fb_dev = usb.core.find(idVendor=0x18D1, idProduct=0xD00D)
+    if fb_dev is not None:
+      print("[*] Detected device in Fastboot mode (18d1:d00d). Sending 'oem reboot-edl'...")
+      _fb_send_edl(fb_dev)
+      usb.util.dispose_resources(fb_dev)
+      time.sleep(1.5)
+      fb_still = usb.core.find(idVendor=0x18D1, idProduct=0xD00D)
+      if fb_still is not None:
+        _fb_upgrade_lk2nd_and_edl(fb_still)
+      return
+  except Exception:
+    pass
+
   try:
     res = subprocess.run(
       ["fastboot", "devices"],
@@ -53,8 +156,10 @@ def try_kick_into_edl():
       timeout=2,
     )
     if res.returncode == 0 and res.stdout.strip():
-      print("[*] Detected device in Fastboot mode. Sending 'fastboot oem edl'...")
-      subprocess.run(["fastboot", "oem", "edl"], timeout=5)
+      print("[*] Detected device in Fastboot mode. Sending 'fastboot oem reboot-edl'...")
+      rc = subprocess.run(["fastboot", "oem", "reboot-edl"], timeout=5)
+      if rc.returncode != 0:
+        subprocess.run(["fastboot", "oem", "edl"], timeout=5)
       time.sleep(1)
   except Exception:
     pass
@@ -69,9 +174,10 @@ def wait_for_edl_usb(vid, pid, device_label, timeout_sec=0):
     f"(USB {vid:04x}:{pid:04x} Qualcomm QDLoader 9008)..."
   )
   print("    To enter EDL mode on the phone, use one of:")
-  print("      1) Power off, hold D-Pad Up + D-Pad Down, and plug in USB")
-  print("      2) Plug in via an EDL deep-flash cable")
-  print("      3) Run 'adb reboot edl' or 'fastboot oem edl'")
+  print("      1) From lk2nd Fastboot menu, select 'EDL' (or connect in Fastboot mode)")
+  print("      2) Power off, hold D-Pad Up + D-Pad Down, and plug in USB")
+  print("      3) Plug in via an EDL deep-flash cable")
+  print("      4) Run 'adb reboot edl' or 'fastboot oem reboot-edl'")
 
   start_ts = time.time()
   dots = 0