AudioCodes MP202B hacking notes (Netvision)

This is a no-go

These are notes during my failed attempts to turn an old (2011?) Israeli ISP provider’s SIP adapter (MP202B, provided by Netvision) into one that works with any SIP provider. The first step is to get access of its configuration, and that’s exactly where it stopped.

Netvision has taken action to prevent any manipulations, in particular by keeping the access password secret (or maybe there is no password at all?). Some will call it customer retention.

So here is my war story. Sometimes you win, sometimes you lose.

Trying the nice way

Plugged the adapter’s LAN Ethernet jack to my laptop through the USB Ethernet adapter. The adapter served as a DHCP server, and gave the laptop the address 10.100.102.2. The default gateway as well as nameserver were set to 10.100.102.1.

So far so good. I opened the browser, and attempted to open the http://mp202.home, as the manual says. The browser complained that page can’t be opened, and indeed, a DNS query was made, giving the A address records 10.100.102.1 and 10.192.0.1 for that domain, however the attempt to open a TCP connection on port 80 of either of these addresses was responded with a flat TCP RST.

But it does work with http://mp202.home:8080 instead.

Telnet also worked, prompting for user and password.

However I failed to login, both from telnet and via the web interface. The default admin/admin pair didn’t work, and neither did the user/wel-012! pair mentioned a lot in forums, specifically for the adapter from Netvision. Word has it in old forums that Netvision changes the password all the time to prevent users from fiddling with their equipment. Peculiarly, when typing “user” at telnet’s prompt, it doesn’t ask for password, but goes on asking for username again.

So reset to factory defaults. The instructions in the Manual were to hold the RST pin for 7 seconds and up, but that did nothing. So I powered the device off, disconnected the network cable, and repowered with the RST pin held for a few seconds. And that clearly made a difference — in particular, the device stopped attempting to contact the SIP server as it did before.

Also: The LAN server now answered to port 80 for http://mp202.home.

But none of the user/password combinations I could think about worked.

Opening the MP202B

The screws are under the small rubber pieces that hold the adapter, four of them. There’s just a small PCB, with one interesting pin header, labeled JP1. Three pins. As this is obviously a Linux system, there’s almost a UART header. And this is the case.

So JP1 is UART, 3.3V, plain 115200 8N1. Plain USB adapters work. Connection:

• Pin 1: Tx (driven by adapter). White wire
• Pin 2: GND
• Pin 3: Rx (pulled up by device). Green wire.

For some reason, the adapter didn’t boot up when pin 3 was connected to the green wire. So disconnect, let it boot (the boot messages are visible), connect the green wire and reboot by a quick power cycle.

As one can guess from the introduction, this didn’t help much either: Except for a lot of boot messages (see below), the serial port requires a login, exactly the same as the telnet.

The one thing I could possibly have done is to tftp an image of the mounted file system to my computer, mount it there, change the /etc/passwd file and then write it back to the flash. Maybe that would have worked.

However this is where it stopped to be fun, and my time is worth more than that.

Speaking of fun, a serial port session log follows. Note how clean and elegant the boot messages are. Or: I don’t know why it always ends up like this on closed hood systems.

Session log

Flash found: MX29LV640DBTC
Press ESC for monitor... 22
(ac494bl) help
reboot            version           info              fa
printenv          setenv            unsetenv          defragenv
fmt               boot              boot_recovery     dm
oclk              help              tftp              memtest           

(ac494bl) boot_recovery

Booting...
Uncompressing Linux.................................................................................................................Ok
Booting the kernel at 0x94020790

LINUX started...
CPU revision is: 00018448
Primary instruction cache 16kb, linesize 16 bytes (4 ways)
Primary data cache 16kb, linesize 16 bytes (4 ways)
Linux version 2.4.21openrg-rmk1 #5 Mon Sep 7 13:40:37 IDT 2009

 leds re-enabled @@@

Determined physical RAM map:
 memory: 14000000 @ 00000000 (reserved)
 memory: 00020000 @ 14000000 (ROM data)
 memory: 00f60000 @ 14020000 (usable)
On node 0 totalpages: 3968
zone(0): 3968 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/ram0 rw
calculating r4koff... 00098968(625000)
CPU frequency 125.00 MHz
Calibrating delay loop... 124.92 BogoMIPS
Freeing Adam2 reserved memory [0x14001000,0x0001f000]
Memory: 11972k/15872k available (1131k kernel code, 3900k reserved, 2388k data, 4k init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  available.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd

Random: 0x323bdaca
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xa8610e00 (irq = 15) is a 16550A
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (tmpfs filesystem).
Mount of initial cramfs successful
Freeing init cramfs memory: 64k freed
Freeing unused kernel memory: 4k freed
Mounting cramfs image at 'cramfs'
Algorithmics/MIPS FPU Emulator v1.5
insmod: add-symbol-file PATH/kos_lib.o 0xc0000060 -s .data 0xc000ddc0 -s .bss 0xc000eb90
insmod: add-symbol-file PATH/avaavalanche flash device: 0x800000 at 0x10000000.
lanche_flash_mod-----> [jedec_probe_chip:669]mfr=0x00C2, id=0x22CB, base=0x0000, osf=0x0002.
.o 0xc0011060 -sFound: Macronix MX29LV640DBTC
 .data 0xc001196Physically mapped flash:0: Found 1 x16 devices at 0x0 in 16-bit mode
0 -s .bss 0xc001 Amd/Fujitsu Extended Query Table vÿ.ÿ at 0x0000
1a80
number of CFI chips: 1
avalanche flash device: 0x800000 at 0x1d000000.
-----> [jedec_probe_chip:669]mfr=0x0000, id=0x0000, base=0x0000, osf=0x0002.
-----> [jedec_probe_chip:669]mfr=0x0000, id=0x0000, base=0x0000, osf=0x0002.
-----> [jedec_probe_chip:669]mfr=0x9090, id=0x9090, base=0x0000, osf=0x0002.
-----> [jedec_probe_chip:669]mfr=0x9090, id=0x9090, base=0x0000, osf=0x0002.
-----> [jedec_probe_chip:669]mfr=0x9090, id=0x9090, base=0x0000, osf=0x0004.
-----> [jedec_probe_chip:669]mfr=0x9090, id=0x9090, base=0x0000, osf=0x0004.
JEDEC: Found no Physically mapped flash:1 device at location zero
registering mtd failed
failed initializing  flash dev 1
Looking for mtd device :mtd0:
Found a mtd0 image (0x10000), with size (0x560000).
Creating 1 MTD partitions on "Physically mapped flash:0":
0x00010000-0x00570000 : "mtd0"
Looking for mtd device :mtd1:
insmod: add-symbol-file PATH/avalanche_cpmac.o 0xc0013060 -s .data 0xc0024240 -s .bss 0xc0024bf0
loading license key: AUDIOCODES
Press ESC to enter BOOT MENU mode.
[mt_rg_conf_compat:2333] saved_version=4.10.4.5.2, rg_version=4.1.7.3.7, saved_ext_version=3.0.1_p041_build_19, external_version=2.6.2_p10_build_2 .
[mt_rg_conf_compat:2335] UPDATING SERIAN NUMBER .....
ACL_GetSerialNumberFromMAC: mac_str = 00:90:8F:2F:9B:92
ACL_GetSerialNumberFromMAC: iserial_num=3120018 .
[mt_rg_conf_compat:2350] check_branch=-1!!!
[mt_rg_conf_compat:2353] restoring default configuration - new ACL branch !!!

Going to reboot!
Restarting system.

Flash found: MX29LV640DBTC
Press ESC for monitor... 221
(ac494bl) help
reboot            version           info              fa
printenv          setenv            unsetenv          defragenv
fmt               boot              boot_recovery     dm
oclk              help              tftp              memtest           

(ac494bl) version

PSPBoot 2.3.0.4
Compiled gcc rev: 3.3.2 [Aug  5 2008 12:29:56]
Built for MP202 board in Little Endian mode.

Optional modules included (+) or not (-):
 +tibinary +elf -gzip -ffs +tftp -ftp -dhcp -pcapp
(ac494bl) info

CHIP ID: TNETV1050 (0x7), REV: 0x2

MIPS Processor   : 4KEc rev: 2.2.0
Cache mode       : write-back, write-allocate.
Instruction cache: Associativity: 4, Line size: 16, Total size: 16KB
Data cache       : Associativity: 4, Line size: 16, Total size: 16KB

Last reset cause: Software reset (memory controller also reset)

EMIF is running at the same speed of the processor.
Processor running in little endian mode.
Processor clock is synchronous to internal bus clock.

(ac494bl) fa
Current Flash Allocation:

section :   PSBL, base : 0xb0000000, size :      50368 bytes
section :    ENV, base : 0xb07f0000, size :      65536 bytes

unallocated Space Start: 0xb0010000
unallocated Space End  : 0xb07f0000

(ac494bl) printenv

HWA_0        	00:01:02:03:04:05
HWA_ESWITCH  	00:90:8F:04:C0:8F
MAXLDRVER    	2.3.0.4
MODETTY0     	115200,n,8,1,hw
MODETTY1     	115200,n,8,1,hw
CPUFREQ      	125000000
SYSFREQ      	125000000
PROMPT       	(ac494bl)
mtd2         	0x90000000,0x90010000
mtd0         	0x90010000,0x90570000
mtd3         	0x907f0000,0x90800000
mtd4         	0x90570000,0x907f0000
BOOTRECOVERY 	m:f:"mtd4"
BOOTCFG      	m:f:"mtd0"
IPA          	192.168.1.1
IPA_GATEWAY  	192.168.1.254
SUBNET_MASK  	255.255.255.0
IPA_SVR      	192.168.1.2
MEMSZ        	0x00f80000
FLASHSZ      	0x00800000
BANNER       	1
FACTORY_DFT  	0

(ac494bl) boot
[boot 84] attempt (0) trying to boot from (BOOTCFG)

Booting...

sizeof(char): 00000001
sizeof(short): 00000002
sizeof(int): 00000004
sizeof(size_t): 00000004
sizeof(long): 00000004
sizeof(addr_t): 00000004
CONFIG_MTD_PHYSMAP_START: 90000000
CONFIG_MTD_PHYSMAP_LEN: 00800000
KERNEL_START: 94020000
virt_to_program(KERNEL_START): 94020000
HEAD_ADDR: 94C00000
CRAMFS_TARGET_ADDR: 943C2000
CRAMFS_LEN: 00300000
head_start_addr: 94C0000C
start_addr: 90010018
program_to_phys(start_addr): 90010018
offset: FB41000C
&_compressed_kernel_start: 94C02170
&_compressed_kernel_end: 94CDD602
compressed_kernel_start: 9001217C
compressed_kernel_len: 000DB492
Uncompressing Linux...
from: 9001217C
output_data: 94020000
output_len: 00BE0000
..........................................................................................................res: 00358000
Done
&_rofs_start: 94CDE000
&_rofs_end: 94FDE000
test: 90010018
_PA(test): 90010018
_PA(CONFIG_MTD_PHYSMAP_START): 90000000
_PA(CONFIG_MTD_PHYSMAP_START) + CONFIG_MTD_PHYSMAP_LEN: 90800000
test: 90010018
CramFS in Flash
Check CRC ... ||\-/|\-/|\-/177EC94A OK
cramfs_start_src: 00000000
CramFS dump (offsets in words):
+0: 28CD3D45
+1: 00300000
+2: 0000A003
kernel: 94020790
Kernel dump:
+0: 3C1C9415
+1: 279C2000
+2: 27881FE0
Booting the kernel

LINUX started...
rofs_addr: 900ee00c (100ee00c), len: 300000, flash_start_addr: 90000000 (10000000) flash_len: 800000
CramFS in Flash (prom)
rofs_start_addr: 00000000 len: 0
CPU revision is: 00018448
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB 4-way, linesize 16 bytes.
Linux version 2.4.21openrg-rmk1 #122 Wed Dec 15 18:44:20 IST 2010

 leds re-enabled @@@

Determined physical RAM map:
 memory: 14000000 @ 00000000 (reserved)
 memory: 00020000 @ 14000000 (ROM data)
 memory: 00f60000 @ 14020000 (usable)
Using memsize of f80000
On node 0 totalpages: 3968
zone(0): 3968 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: cramfs=flash mtdparts=phys_mapped_flash:0x800000@0(Gateway),0x300000@0x000ee00c(mainfs) slram=initfs,0x14368000,+65536 console=ttyS0,115200 root=/dev/ram0 rw
calculating r4koff... 00098968(625000)
CPU frequency 125.00 MHz
Calibrating delay loop... 124.51 BogoMIPS
Freeing Adam2 reserved memory [0x14001000,0x0001f000]
Memory: 11964k/15872k available (1216k kernel code, 3908k reserved, 2184k data, 4k init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  available.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
/proc/fs/cramfs_block_uncompressed created
/proc/fs/cramfs_location created

Random: 0x665ef687
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xa8610e00 (irq = 15) is a 16550A
AVALANCHE flash device: 800000 at 10000000
-----> [jedec_probe_chip:669]mfr=0x00C2, id=0x22CB, base=0x0000, osf=0x0002.
Found: Macronix MX29LV640DBTC
Avalanche Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit mode
 Amd/Fujitsu Extended Query Table vÿ.ÿ at 0x0000
number of CFI chips: 1
Using command line partition definition
Creating 2 MTD partitions on "Avalanche Physically mapped flash":
0x00000000-0x00800000 : "Gateway"
0x000ee00c-0x003ee00c : "mainfs"
mtd: partition "mainfs" doesn't start on an erase block boundary -- force read-only
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (tmpfs filesystem).
making node /dev/mtdblock3 (initfs)
Mount of initial cramfs successful
Error making node /dev/mtdblock2
making node /dev/mtdblock2 (mainfs)
Freeing unused kernel memory: 4k freed
AVALANCHE flash device: 800000 at 10000000
-----> [jedec_probe_chip:669]mfr=0x00C2, id=0x22CB, base=0x0000, osf=0x0002.
Found: Macronix MX29LV640DBTC
Avalanche Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit mode
 Amd/Fujitsu Extended Query Table vÿ.ÿ at 0x0000
number of CFI chips: 1
Using command line partition definition
Creating 2 MTD partitions on "Avalanche Physically mapped flash":
0x00000000-0x00800000 : "Gateway"
0x000ee00c-0x003ee00c : "mainfs"
mtd: partition "mainfs" doesn't start on an erase block boundary -- force read-only
Algorithmics/MIPS FPU Emulator v1.5
Version: 3.0.1_p041_build_19
Platform: AudioCodes MP20xB Board With SILABS Slic
Compilation Time: 15-Dec-10 16:38:49
Tag: Ntag-4_10_4_X_X
Compilation Flags: CONFIG_RG_VOIP_RV_MGCP=n CONFIG_RG_VOIP_RV_SIP=y BUILD=build.REV_B_SIP DIST=MP20XB_SILABS_VGW LIC=../jpkg_audiocodes.lic
User Information: audiocodes@localhost.localdomain /home/audiocodes/work/mp20x_4.10/amil_MP20x_4.10_dev6/CMBU/tulip/rg

insmod: add-symbol-file build/debug/one_module.o 0xc0011060 -s .main_flow 0xc00543e0 -s .data 0xc005f8b0 -s .bss 0xc0061760
Loading license 28fddd6dd30365cff7d05e4bb8a26f22278422545c33a022d98c810b0bb80b20e41b129a325365e4f9c05b80ddd328a75e03274f4deaca09dbd709b6c122b06cd49fd349748a7384cffce9e3297ce45d.Audiocodes
loading license key: Audiocodes

insmod: add-symbol-file build/debug/avalanche_cpmac.o 0xc009c060 -s .data 0xc00ad2b0 -s .bss 0xc00adc60
loading license key: Audiocodes
Press ESC to enter BOOT MENU mode.
ata_pages_init,52 --
[mt_rg_conf_compat:3778] saved_version=4.10.4.5.2, rg_version=4.10.4.5.2, saved_ext_version=3.0.1_p041_build_19, external_version=3.0.1_p041_build_19 .
[mt_rg_conf_compat:3779] UPDATING SERIAL NUMBER .
ACL_GetSerialNumberFromMAC: mac_str = 00:90:8F:2F:9B:92
ACL_GetSerialNumberFromMAC: iserial_num=3120018 .
[mt_rg_conf_compat:3793] updating remote access path
MAPS:
00400000-0090d000 r-xp 00000000 1f:02 158032     /mnt/cramfs/bin/openrg
10000000-1009c000 rw-p 0050d000 1f:02 158032     /mnt/cramfs/bin/openrg
1009c000-10158000 rwxp 00000000 00:00 0
7ffInitializing env_params module
f7000-7fff8000 rwxp 00000000 00:00 0

insmod: add-symbol-file build/debug/ac49x_env_mod.o 0xc00c0060 -s .data 0xc00c0300 -s .bss 0xc00c0360

insmod: add-symbol-file build/debug/ac49x_led_mod.o 0xc00c2060 -s .data 0xc00c3f30 -s .bss 0xc00c3f70

insmod: add-symbol-file build/debug/log_chardev.o 0xc00c6060 -s .data 0xc00c6960 -s .bss 0xc00c69e0

insmod: add-symbol-file build/debug/igmp_proxy_mod.o 0xc00c8060 -s .main_flow 0xc00cdd64 -s .data 0xc00ce2a0 -s .bss 0xc00ce3a0

insmod: add-symbol-file build/debug/tcp_mss.o 0xc00d0060 -s .data 0xc00d06e0 -s .bss 0xc00d0710

insmod: add-symbIPV4 device driver registered
ol-file build/debug/rg_ipv4.o 0xc00d2060 -s .data 0xc00d2290 -s .bss 0xc00d22e0

insmod: add-symbol-file build/debug/pppoe_relay.o 0xc00d4060 -s .data 0xc00d6db0 -s .bss 0xc00d6db0

insmod: add-symbol-file build/debug/rg_pppoe_relay.o 0xc00eb060 -s .data 0xc00eb7e0 -s .bss 0xc00eb870

insmod: add-symbol-file build/debug/ac49x_dsp_mod.o 0xc00ed060 -s .data 0xc0106450 -s .bss 0xc0185bf0
dsp memory at block 14c00000
starting vlynq_vdsp configuration...
Failed to initialize the vlynq @ 0xa8611c00.
error msg = Error in configuring clocks..
failed on AcVlynq_Init_SoC_VlynqHi__to__AC498_VlynqLow possibly no vlynq
putting vlynq back in reset...

insmod: add-symbol-file build/deDSP-TELE: SPCR1 reg value = 0x10800FF .
bug/ac49x_mpi_moDSP-TELE: Telephony Interface driver installed.
d.o 0xc018b060 -s .data 0xc018bc10 -s .bss 0xc018bc60

insmod: add-symbol-file build/debug/silabs_daa_3050_drv_mod.o 0xDAA Driver init_module !!!
c018d060 -s .data 0xc0190190 -s .bss 0xc0190280

insmod: add-symbol-file build/debug/silabs_fxs_3215_drv_mod.o 0xc0192060 -s .data 0xc0197fe0 -s .bss 0xc0198e70

insmod: add-symbol-file build/debug/rtp.o 0xc019b060 -s .data 0xc019e1c0 -s .bss 0xc019e1f0

insmod: add-symbol-file build/debug/phone_mod.o 0xc01a0060 -s .data 0xc01a1090 -s .bss 0xc01a10e0

insmod: add-symbol-file build/debug/ac494_mod.o 0xc01a3060 -s .data 0xc01ab120 -s .bss 0xc02277d0

****** AC49x init_module *****

insmod: add-symbol-file build/debug/qos_ingress.o 0xc0238060 -s .main_flow 0xc02Freeing modfs memory: 2036k freed
38980 -s .data 0xc0238b50 -s .bss 0xc0238bf0
factory dft = 0
mt_rg_conf_bad_reboot_verify(). Reboot reason 1
 1 consecutive reboots
getMp20XProdName:116 Need to check g_rg_prod_name (MP20X)
[init:234]
starting voip task watchdog
[AutoDialer_Start: 821]->
[init: 781]->
[init_connection_list: 273]-> num of object list(3)
[init_connection_list: 292]allocating (2) object
[init_connection_obj: 248]dialer type is DHCP
[init_connection_obj: 249]dialer retries(4)
[init_connection_obj: 250]dialer retries timeout(5)
[init_connection_list: 292]allocating (1) object
[init_connection_obj: 220]dialer UserName(fprod-13@INetvision)
[init_connection_obj: 221]dialer Password(827456)
[init_connection_obj: 248]dialer type is PPPOE
[init_connection_obj: 249]dialer retries(4)
[init_connection_obj: 250]dialer retries timeout(5)
[init_connection_list: 292]allocating (0) object
[init_connection_obj: 220]dialer UserName(fprod-12)
[init_connection_obj: 221]dialer Password(676261)
[init_connection_obj: 236]dialer ServerIp(cable.netvision.net.il)
[init_connection_obj: 248]dialer type is L2TP
[init_connection_obj: 249]dialer retries(4)
[init_connection_obj: 250]dialer retries timeout(5)
[init_connection_list: 309]<-
[test_status_init: 325]mgt_int_conn_diag_t(0x10194110) size(464)
[test_status_init: 337]mgt_icd_status_t(0x10193190) size(20) test_id(1)
[test_status_init: 337]mgt_icd_status_t(0x10193428) size(20) test_id(2)
[test_status_init: 337]mgt_icd_status_t(0x10193440) size(20) test_id(4)
[test_status_init: 337]mgt_icd_status_t(0x10193458) size(20) test_id(16)
[init: 812]JL need to add led init here!!!
[init: 813]<-
[AutoDialer_Start: 833]<-
VoIP task started
[test_phys_conn_cb: 757]->
[test_start: 480]->
[test_start: 482]<-
[get_test_results: 494]->
[get_test_results: 498]physical link test is in progress
[get_test_results: 502]
tests results are: status(ICD_FAILURE) spesific(ICD_PHYS_LINK_ETH)
[get_test_results: 504]<-
[test_phys_conn_cb: 761]Failed detecting physical connection
[controller: 516]->
[controller: 528]Auto dialer detection failed. restarting process. 0 retries left
[reset_dialer_list_parameters: 427]->
[reset_dialer_list_parameters: 435]<-
[controller: 532]<-
[test_phys_conn_cb: 769]<-
[test_phys_conn_cb: 757]->
[test_start: 480]->
[test_start: 482]<-
[get_test_results: 494]->
[get_test_results: 498]physical link test is in progress
[get_test_results: 502]
tests results are: status(ICD_FAILURE) spesific(ICD_PHYS_LINK_ETH)
[get_test_results: 504]<-
[test_phys_conn_cb: 761]Failed detecting physical connection
[controller: 516]->
[controller: 536]Auto dialer detection process failed
[controller: 538]JL need to change led status to slow red flash and set dialer to dhcp

Auto Dialer Detect Statistics Summery
-------------------------------------

dialer name: L2TP
status: not tested
time spent on dialer connection: 0 sec

dialer name: PPPOE
status: not tested
time spent on dialer connection: 0 sec

dialer name: DHCP
status: not tested
time spent on dialer connection: 0 sec

total running time: 0 seconds
[uninit: 402]->
[uninit_connection_list: 376]->
[uninit_connection_list: 391]<-
[uninit: 415]<-
[controller: 546]<-
[test_phys_conn_cb: 769]<-
[voip.c:1507] checking SLICIOC_R_FXS_READ_INIT_DONE for dev /dev/ac494_slic1
[voip.c:1526] init_done = 0.
[voip.c:1535] setup a new timer .
Username: Failed detecting physical connection

Failed detecting physical connection

Auto dialer detection process failed

[mt_voip_ipc 870] voip is ready for ipc
voip: new configuration parameters loaded
[voip_conf_get_number_of_dsp_devices:3342] iNumO----------i = DSP_REGIONAL_SETTINGS_CALL_PROGRESS_CALL_WAITING_TONE ----------
fDspDevices=1, iac494_configure_dsp: about to configure time slots, iNumOfAnalogChannels=2.
First=1.
ac494_configure_dsp: THE END !!!!
TimerInit: pTimerObj->ticksPerSecond=0x64 .
CountryName=USA
ACL_Si321x_GetCountryIndex: Found a match (country=USA, index=0) .
Si321x_ZsynthSetup
Si3215-16 Rev C
CountryName=USA
ACL_Si321x_GetCountryIndex: Found a match (country=USA, index=0) .
Si321x_ZsynthSetup
Si3215-16 Rev C
[phone_api.c:60] slic_status_polling ...
[phone_api.c 74] polling on slic status(1)

[phone_api.c 106] passed slic_status_polling
[voip.c:1507] checking SLICIOC_R_FXS_READ_INIT_DSilabs drv: SLICIOC_W_FXS_WRITE_CALIBRATION_RESULTS_PRECONFIG (channel=0, scFXSCalibrationWriteCounter=1) .
ONE for dev /dev Reg98=16, Reg99=17, Reg100=17, Reg101=17, Reg102=5, Reg103=54, Reg105=216, Reg107=8
/ac494_slic1
[vslic_ioctl:cmd BLOCKED=4004eea1 runing=8004ee90
oip.c:1526] initerror reading sys_ioctl
_done = 1.
[voip.c:1543] FXS Calibration is notSilabs drv: SLICIOC_W_FXS_WRITE_CALIBRATION_RESULTS_PRECONFIG (channel=1, scFXSCalibrationWriteCounter=2) .
 required, use pslic_ioctl:cmd BLOCKED=4004eea1 runing=8004ee90
reconfiured paraerror reading sys_ioctl
ms.
 [voip.c 1 Reg98=15, Reg99=15, Reg100=17, Reg101=14, Reg102=7, Reg103=87, Reg105=43, Reg107=7
393] mt_voip_slic_calibration_done_parameters_poll: Calibration Results:
 Reg98=16, Reg99=17, Reg100=17, Reg101=17, Reg102=5, Reg103=54, Reg105=216, Reg107=8
 [voip.c 1393] mt_voip_slic_calibration_done_parameters_poll: Calibration Results:
 Reg98=15, Reg99=15, Reg100=17, Reg101=14, Reg102=7, Reg103=87, Reg105=43, Reg107=7
RV conf using localAddress 10.100.102.1
RV conf using userDomain 10.100.102.1
calling rvIppSipStackInitialize
rvIppSipStackInitialize returned OK
**** mt_voip_ext_conf_poll: num_of_fxos_lines=2, num_of_fxo_lines=0 

 acl_rg_conf_voip_ext_commit
memory_watchdog: interval=10000, memory_margin=3500 .
rmt_cfg_start>>
automatic dialer detection process done!
automatic dialer detection process failed!

The boot loader is PSP Boot, of course.