De-bricking a B593-s22

I finally did it!
The unit has been non-functional for over a year now. See details in my previous post. But I got it back.

First, I'd like to clarify the myth of "equipment mode". Yes, that does exist. You'll know that your box is bricked and the reason for that is because you're in equipment mode, as your RS-232 -console output will say following during boot-up:

now in wifi mfg
g_Equip_Mode_value = 1

What needs to be done, is getting that Equip_Mode flag off. On "normal" mode bootup, two distinct differences appear at the output:

now in wifi release
normal mode, no need to load RF wifi
and
g_Equip_Mode_value = 0

My sincere thanks goes to Mr. Jevgenij for telling me a magical NVRAM-location to look at.

The brick

My bricked B592 s-22 (in equipment mode) looked like this on a boot sequence:

(Sorry about the signal LED glowing, that was my failure when lighting the box for video. I didn't realize that on my footage it looks like being lit, while in reality it isn't. A bricked box won't show any signal there.)

At power-on, the Power-LED gets lit all the others are off. Then the boot-sequence handles lot of hardware and gets a Linux to boot. They call it the "early init". There are no differences between modes at that point.

Next, what happens is the Linux-side taking control and starting to spin up services. One of the first things it does is kicking all the LEDs lit. When enough services are on, and Linux wants to fiddle with LTE-side all the LEDs go off. Now that the device is configured not to offer all hardware services to Linux-side, rest of the boot sequence goes haywire. There is no Wi-Fi, there is no Ethernet-bridge and lot of stuff fail during boot. Your best clue about this dreaded equipment mode is the Tel LED blinking on/off forever. Actually the box is not doing much at that point. It has given up all hope on getting a handle of the LTE-side or the Ethernet bridge.

Luckily, the box is sane enough to allow a SSH-login. In equipment mode, it will bypass the ATP Cli completely and land at the BusyBox-prompt. There your friend is lteat-command. Go back to my older stuff, for details about that.

The fix

The prerequisite for the fix is, that you are logged into your B593 s-22 via SSH and are able to run lteat and get sensible response out of it. Example (the blank lines happen on my SSH, I don't know why):

# lteat
AT>ati

i

Model: B593s-22

Revision: V200R001B180D20SP05C260

IMEI: 860091028600910

+GCAP: +CGSM,+DS,+ES

OK
AT>

Then you're good to go.

First confirm, that you are in the equipment mode:

AT>at ^nvrd=52110
^NVRD: 12,31 00 00 00 00 00 00 00 00 00 00 00
OK

That's a ReaD-command for NVRAM address location 52110. To change the mode back to normal, a WRite needs to be issued:

AT>at ^nvwr=52110,1,0
OK

Confirm the result:

AT>at ^nvrd=52110
^NVRD: 12,00 00 00 00 00 00 00 00 00 00 00 00
OK

Notice how the hex value 0x31 is changed to 0x00. Btw. if you look at the ASCII-table, you may notice, that 0x31 stands for number 1. That's would be similar to the (1) in g_Equip_Mode_value = 1.

Now all you have to do is power-off your box and kick it back on.

Finally

I don't have a clue why/how/when my box went into this "stupidity"-mode. I was fiddling with the LTE-side at lteat-prompt when it happened. I did try dozens of different commands, any of those may have caused that.

Also, if you're unable to SSH into your box, you may need to read my or somebody else's articles. It's all explained there.