Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision
Previous revision
Next revisionBoth sides next revision
inbox:toh:actiontec:f2250 [2022/01/30 04:34] – Created from the form at meta:create_new_device_page kenballusinbox:toh:actiontec:f2250 [2022/01/30 16:41] – [Official Firmware] kenballus
Line 6: Line 6:
 {{page>meta:infobox:construction&noheader&nofooter&noeditbtn}} {{page>meta:infobox:construction&noheader&nofooter&noeditbtn}}
  
-//Write short, relevant description of the deviceInclude technical overviewbut avoid marketing buzzwords/useless stuffTwo to four sentences is about rightA picture is goodtoo. Edit the page to see how to add pictures.// +The Actiontec F2250 is DSL modem that was distributed by Frontier CommunicationsIt features dual-core Broadcom MIPS CPU128 MB of RAM, 128 MB of NAND flash, 802.11n at 2.4 GHzand 4 ethernet ports.
- +
-/*****/ +
-/* How to add images ========> https://openwrt.org/meta/adding_images_to_openwrt_wiki */ +
-/*****/ +
- +
-{{ media:example:genericrouter1.png?200|Generic Router}} +
  
 +{{ media:actiontec:f2250.png?200|Actiontec F2250 }}
 ===== OpenWrt support ===== ===== OpenWrt support =====
  
-<color red>**Not supported.**</color>+<color red>**Work in progress.**</color>
  
  
Line 41: Line 35:
  
  
 +===== Official Firmware =====
 +[[http://opensource.actiontec.com/f2250.html|Actiontec GPL source]]
 +
 +The GPL sources are pretty straightforward to build; just ensure that you have 32-bit libs installed and everything should go smoothly.
 +It's recommended to build the GPL sources in a VM or a chroot because they will chmod -R 777 your /opt, which will break a lot of programs that install to /opt.
 +
 +[[https://upgrade.actiontec.com/Frontier/|Official firmware images]]
 +
 +These files are not referenced by Actiontec or Frontier. They were found by searching the stock firmware for URLs.
 ===== Hardware highlights ===== ===== Hardware highlights =====
-^ CPU                        ^ Ram      ^ Flash   ^ Network     ^ WLAN   ^ USB      ^ Serial   ^ JTag   +^ CPU                    ^ Ram     ^ Flash   ^ Network   ^ WLAN  ^ USB    ^ Serial   ^ JTag ^   
-EXAMPLE RT3052 384 MHz    64 MiB   MiB   4x 10/100   bgn    1x 2.0    Yes      ?    |+BCM63168D0 400 MHz   128 MiB | 128 MiB | 4x 10/100 | b/g/n | 1x 2.0 | Yes      | ?    | 
  
 +===== Getting a root shell in the stock firmware =====
 +The root password in the stock firmware remains unknown, but there is still an easy method to get a root shell.
 +Hook up to the UART, wait for the router to finish booting, then press Ctrl-\.
 +This will kill the login process and drop you straight into a root shell.
 +Big thank you to whoever filed [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12789|this CVE]].
  
 /*** if info available: uncomment and fill in /*** if info available: uncomment and fill in
Line 90: Line 98:
 ***/ ***/
  
- +===== Buttons =====
-/*** if info available: uncomment and fill in +
-==== Buttons ==== +
--> [[docs:guide-user:hardware:hardware.button]] on howto use and configure the hardware button(s). +
-Here, we merely name the buttons, so we can use them in the above Howto. +
- +
-<WRAP BOX 600px> +
-FIXME Please fill in real values for this device, then remove the EXAMPLEs and the WRAP that encloses this text. +
 The Actiontec F2250 has the following buttons: The Actiontec F2250 has the following buttons:
  
-^ BUTTON                       ^ Event   ^ +^ BUTTON ^ Event   ^ 
-EXAMPLE Reset                |  reset  | +| Reset  |  reset  | 
-EXAMPLE Secure Easy Setup      ses   +WPS     ?      
-| EXAMPLE No buttons at all.      -    | +
-</WRAP> +
-***/+
  
  
 ===== Hardware ===== ===== Hardware =====
 ==== Info ==== ==== Info ====
-^ Architecture     EXAMPLE MIPS                             | +^ Architecture     | MIPS                             | 
-^ Vendor           EXAMPLE Ralink                           | +^ Vendor           Broadcom                           | 
-^ Bootloader       EXAMPLE U-Boot                           | +^ Bootloader       CFE                           | 
-^ System-On-Chip   EXAMPLE Ralink RT3052 - MIPS 24K V4.12   | +^ System-On-Chip   BCM63168UKFEBG   | 
-^ CPU/Speed        | EXAMPLE 451 MHz                          | +^ CPU/Speed        | 400 MHz                          | 
-^ Flash-Chip       EXAMPLE unkown                           | +^ Flash-Chip       ESMT F59L1G81A or SK Hynix H27U1G8F2B                           | 
-^ Flash size       EXAMPLE 8 MiB                            | +^ Flash size       128 MiB                            | 
-^ RAM              | EXAMPLE 64 MiB                           +^ RAM              | 128 MiB                           | 
-^ Wireless         | EXAMPLE RT2860v2 2.4GHz 802.11bgn        | +^ Switch           BCM53125         | 
-^ Ethernet         | EXAMPLE 10/100 Mbit/s w/ vlan support    +^ USB              | 1x 2.0                           | 
-^ Switch           EXAMPLE Qualcomm Atheros QCA8337         | +^ Serial           | [[#Serial|Yes]]                  |
-^ USB              | EXAMPLE 1x 2.0                           | +
-^ Serial           EXAMPLE [[#Serial|Yes]]                  +
-^ JTAG             | EXAMPLE [[#JTAG|Not populated]]          |+
  
- 
-/*** if info available: uncomment and fill in 
 ==== Flash Layout ==== ==== Flash Layout ====
-<WRAP BOX> +0x000003da0000-0x000007ae0000 : "rootfs"\\ 
-FIXME //[[:docs:techref:flash.layout#discovery_how_to_find_out|Find out flash layout]], then add the flash layout table here (copy, paste, modify the [[docs:techref:flash.layout#partitioning_of_squashfs-images|example]]).// +0x000000040000-0x000003d80000 "rootfs_update"\\ 
- +0x000007b00000-0x000007f00000 "data"\\ 
-Please check out the article [[docs:techref:flash.layout|Flash layout]]. It contains examples and explanations that describe how to document the flash layout. +0x000000000000-0x000000020000 : "nvram"\\ 
-</WRAP> +0x000003d80000-0x000003da0000 "tag"\\ 
-***/+0x000000020000-0x000000040000 : "tag_update"\\
  
  
Line 153: Line 146:
 ==== Opening the case ==== ==== Opening the case ====
  
-<WRAP BOX> +Use a case opening tool or a guitar pick to undo the snaps that hold on the transparent faceplate with the LED labels. 
-FIXME //Describe what needs to be done to open the devicee.g. remove rubber feet, adhesive labels, screws, ...// +This faceplate must be removed firstbecause it obscures some screws that must be removed. 
-</WRAP> +Thenremove all screws from the underside of the deviceand the top half of the case should separate from the bottom easily.
 ==== Serial ==== ==== Serial ====
 -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc. -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc.
  
-How to connect to the Serial Port of this specific device:\\ +How to connect to the serial port:
-**Insert photo of PCB with markings for serial port**+
  
-<WRAP BOX> +{{ media:actiontec:f2250_serial.jpg?400|Labeled Serial Port }}
-FIXME //Replace EXAMPLE by real values.// +
-</WRAP>+
  
-^ Serial connection parameters\\ for Actiontec F2250 @@Version@@ EXAMPLE 115200, 8N1 |+^ Serial connection parameters\\ for Actiontec F2250 | 115200, 8N1 |
  
-==== JTAG ==== 
--> [[docs:techref:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. 
- 
-How to connect to the JTAG Port of this specific device:\\ 
-**Insert photo of PCB with markings for JTAG port** 
  
 ===== Bootlogs ===== ===== Bootlogs =====
 ==== OEM bootlog ==== ==== OEM bootlog ====
 <WRAP bootlog> <WRAP bootlog>
-<nowiki>COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE</nowiki>+<nowiki>HELO 
 +CPUI 
 +L1CI 
 +HELO 
 +CPUI 
 +L1CI 
 +DRAM 
 +---- 
 +PHYS 
 +STRF 
 +400H 
 +PHYE 
 +DDR2 
 +SIZ4 
 +SIZ3 
 +SIZ2 
 +DINT 
 +USYN 
 +LSYN 
 +MFAS 
 +LMBE 
 +RACE 
 +PASS 
 +---- 
 +ZBSS 
 +CODE 
 +DATA 
 +L12F 
 +MAIN 
 +FPS0 
 +BT64 
 +0002 
 +BT65 
 +0493 
 +NAN3 
 +RFS2 
 +NAN5 
 + 
 + 
 +CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) 
 +Build Date: Tue May  9 15:41:37 PDT 2017 (dqi@dqi-ThinkPad-T430) 
 +Copyright (C) 2000-2011 Broadcom Corporation. 
 + 
 +NAND flash device: name ESMT F59L1G81A, id 0x92f1 block 128KB size 131072KB 
 +External switch id = 53125  
 +Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz 
 +Main Thread: TP0 
 +Memory Test Passed 
 +Total Memory: 134217728 bytes (128MB) 
 +Boot Address: 0xb8000000 
 + 
 +boot load image is: 48 
 +Board IP address                  : 192.168.1.1   
 +Host IP address                   : 192.168.1.100   
 +Gateway IP address                :    
 +Run from flash/host (f/h)         : f   
 +Default host run file name        : vmlinux   
 +Default host flash file name      : bcm963xx_fs_kernel   
 +Boot delay (0-9 seconds)          : 1   
 +Boot image (0=latest, 1=previous) : 0   
 +Board Id (0-38)                   : F2250   
 +Number of MAC Addresses (1-32)    : 8   
 +Base MAC Address                  : 10:9f:a9:0f:7a:68   
 +PSI Size (1-64) KBytes            : 64   
 +Enable Backup PSI [0|1]           : 1   
 +System Log Size (0-256) KBytes    : 64   
 +Main Thread Number [0|1]          : 0   
 +Board Serial Number               : CVYA4070804278   
 +Factory FW Version                : F2250-36.128L.02   
 +WPS PIN                           : 14108709   
 +WPA KEY                           : eqdb8ynghic32e   
 + 
 +This is one CFE built for FRONTIER 2250 
 +*** Press any key to stop auto run (1 seconds) *** 
 +Auto run second count down: 110 
 +Booting from latest image (0xbbd80000) ... 
 +Decompression OK! 
 +Entry at 0x80336930 
 +Closing network. 
 +Disabling Switch ports. 
 +Flushing Receive Buffers... 
 +16 buffers found. 
 +Closing DMA Channels. 
 +Starting program at 0x80336930 
 +Linux version 2.6.30 (dqi@dqi-ThinkPad-T430) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Tue May 9 15:45:36 PDT 2017 
 +BCM Flash API. Flash device is not found. 
 +F2250 prom init 
 +DSL SDRAM reserved: 0x180000 
 +Zone PFN ranges: 
 +  DMA      0x00000000 -> 0x00001000 
 +  Normal   0x00001000 -> 0x00007e80 
 +Movable zone start PFN for each node 
 +early_node_map[1] active PFN ranges 
 +    0: 0x00000000 -> 0x00007e80 
 +On node 0 totalpages: 32384 
 +free_area_init_node: node 0, pgdat 80429fa0, node_mem_map 81000000 
 +  DMA zone: 32 pages used for memmap 
 +  DMA zone: 0 pages reserved 
 +  DMA zone: 4064 pages, LIFO batch:0 
 +  Normal zone: 221 pages used for memmap 
 +  Normal zone: 28067 pages, LIFO batch:7 
 +Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32131 
 +Kernel command line: root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200 
 +wait instruction: enabled 
 +Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. 
 +Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes 
 +PID hash table entries: 512 (order: 9, 2048 bytes) 
 +Calibrating delay loop... Mount-cache hash table entries: 512 
 +Broadcom Logger v0.1 May  9 2017 15:42:19 
 +Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. 
 +Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes 
 +Total Flash size: 0K with -1 sectors 
 +Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00009a75-00009a70=5<300) 
 +registering PCI controller with io_map_base unset 
 +registering PCI controller with io_map_base unset 
 +bio: create slab <bio-0> at 0 
 +SCSI subsystem initialized 
 +pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] 
 +pci 0000:00:00.0: supports D1 D2 
 +pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] 
 +pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] 
 +PCI: Setting latency timer of device 0000:01:00.0 to 64 
 +skbFreeTask created successfully 
 +BLOG v3.0 Initialized 
 +BLOG Rule v1.0 Initialized 
 +Broadcom IQoS v0.1 May  9 2017 15:45:03 initialized 
 +Broadcom GBPM v0.1 May  9 2017 15:45:03 initialized 
 +PCI: Setting latency timer of device 0000:01:00.0 to 64 
 +Driver 'sd' needs updating - please use bus_type methods 
 +bcm963xx_mtd driver v2.0 
 + ##init_brcm_physmap exit 
 +-->brcmnand_scan: CS=0, numchips=1, csi=0 
 +NAND_CS_NAND_XOR=00000000 
 +Disabling XOR on CS#0 
 +brcmnand_scan: Calling brcmnand_probe for CS=0 
 +B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 
 +brcmnand_read_id: CS0: dev_id=92f18095 
 +After: NandSelect=40000001, nandConfig=15142200 
 +Block size=00020000, erase shift=17 
 +timing1 not adjusted: 6574845b 
 +timing2 not adjusted: 00001e96 
 +brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010 
 +brcmnand_scan: Done brcmnand_probe 
 +brcmnand_scan: B4 nand_select = 40000001 
 +brcmnand_scan: After nand_select = 40000001 
 +100 CS=0, chip->ctrl->CS[0]=0 
 +ECC level 15, threshold at 1 bits 
 +reqEccLevel=0, eccLevel=15 
 +190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010 
 +brcmnand_scan 10 
 +200 CS=0, chip->ctrl->CS[0]=0 
 +200 chip->ecclevel=15, acc=f7ff1010 
 +brcmnand_scan 220 
 +brcmnand_scan 230 
 +brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000 
 +brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0 
 +ECC layout=brcmnand_oob_bch4_4k 
 +300 CS=0, chip->ctrl->CS[0]=0 
 +500 chip=87a44190, CS=0, chip->ctrl->CS[0]=0 
 +-->brcmnand_default_bbt 
 +brcmnand_default_bbt: bbt_td = bbt_main_descr 
 +Bad block table Bbt0 not found for chip on CS0 
 +Bad block table 1tbB not found for chip on CS0 
 +-->brcmnand_isbad_raw(offs=7fe0000 
 +Bad block table written to 0x07fe0000, version 0x01 
 +-->brcmnand_isbad_raw(offs=7fc0000 
 +Bad block table written to 0x07fc0000, version 0x01 
 +brcmnand_scan 99 
 +Creating 6 MTD partitions on "brcmnand.0": 
 +0x000003da0000-0x000007ae0000 : "rootfs" 
 +0x000000040000-0x000003d80000 : "rootfs_update" 
 +0x000007b00000-0x000007f00000 : "data" 
 +0x000000000000-0x000000020000 : "nvram" 
 +0x000003d80000-0x000003da0000 : "tag" 
 +0x000000020000-0x000000040000 : "tag_update" 
 +PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) 
 +PCI: Setting latency timer of device 0000:00:0a.0 to 64 
 +ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM 
 +PCI: Enabling device 0000:00:09.0 (0000 -> 0002) 
 +PCI: Setting latency timer of device 0000:00:09.0 to 64 
 +brcmboard: brcm_board_init entry 
 +SES: Button Interrupt 0x1 is enabled 
 +sesBtn_mapIntr: is_sesBtn_irq_shared=0, sesBtn_irq=1 
 +SES: LED GPIO 0x802b is enabled 
 +PCIe: No device found - Powering down 
 +brcm_board_init: isShared=0, rstToDflt_irq=0 
 +Total # RxBds=1448 
 +bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized 
 + 
 +bcmPktDma_init: Broadcom Packet DMA Library initialized 
 +bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.5 May  9 2017 15:44:44 
 +IPSEC SPU: SUCCEEDED  
 +GACT probability NOT on 
 +Mirror/redirect action on 
 +u32 classifier 
 +    input device check on  
 +    Actions configured  
 +VFS: Mounted root (jffs2 filesystem) readonly on device 31:0. 
 + 
 +init started: BusyBox v1.17.2 (2017-05-09 15:50:22 PDT) 
 + 
 +starting pid 228, tty '': '/etc/init.d/rcS' 
 +Empty flash at 0x002647c4 ends at 0x00264800 
 +Empty flash at 0x00294d04 ends at 0x00295000 
 + 
 +starting pid 234, tty '': '-/bin/sh' 
 + 
 + 
 +BusyBox v1.17.2 (2017-05-09 15:50:22 PDT) built-in shell (ash) 
 +Enter 'help' for a list of built-in commands. 
 + 
 + 
 +Loading drivers and kernel modules...  
 + 
 +bcm96368wdt: module license 'unspecified' taints kernel. 
 +Disabling lock debugging due to kernel taint 
 +brcmchipinfo: brcm_chipinfo_init entry 
 +Broadcom Ingress QoS Module  Char Driver v0.1 May  9 2017 15:43:03 Registered<243> 
 + 
 +Broadcom Ingress QoS ver 0.1 initialized 
 +BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128 
 +Broadcom BPM Module Char Driver v0.1 May  9 2017 15:42:57 Registered<244> 
 +[NTC bpm] bpm_set_status: BPM status : enabled  
 + 
 +NBUFF v1.0 Initialized 
 +Initialized fcache state 
 +Broadcom Packet Flow Cache  Char Driver v2.2 May  9 2017 15:43:04 Registered<242> 
 +Created Proc FS /procfs/fcache 
 +Broadcom Packet Flow Cache registered with netdev chain 
 +Broadcom Packet Flow Cache learning via BLOG enabled. 
 +Constructed Broadcom Packet Flow Cache v2.2 May  9 2017 15:43:04 
 +chipId 0x631680D0 
 +Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 May  9 2017 15:42:58 Registered <241> 
 +Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 
 +FAP Soft Reset Done 
 +4ke Reset Done 
 +Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 
 +FAP Soft Reset Done 
 +4ke Reset Done 
 +FAP Debug values at 0xa5f1e100 0xa5f9e100 
 +Allocated FAP0 GSO Buffers (0xA5F2F188) : 1048576 bytes @ 0xA5800000 
 +Allocated FAP1 GSO Buffers (0xA5FAF188) : 1048576 bytes @ 0xA5900000 
 +Allocated FAP0 TM SDRAM Queue Storage (a5f2f18c) : 341376 bytes @ a5a00000 
 +Allocated FAP1 TM SDRAM Queue Storage (a5faf18c) : 341376 bytes @ a5a80000 
 +[NTC fapProto] fapReset  : Reset FAP Protocol layer 
 +[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> 
 +[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> 
 +[FAP0] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576> 
 +[FAP1] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576> 
 +[FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 
 +[FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 
 +[FAP0] GSO Buffer set to 0xA5800000 
 +[FAP1] GSO Buffer set to 0xA5900000 
 +[FAP0] FAP BPM Initialized. 
 +[FAP1] FAP BPM Initialized. 
 +fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes 
 +fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes 
 +bcmPktDma_bind: FAP Driver binding successfull 
 +[FAP0] FAP TM: ON 
 +[FAP1] FAP TM: ON 
 +bcmxtmcfg: bcmxtmcfg_init entry 
 +adsl: adsl_init entry 
 +Broadcom BCM63168D0 Ethernet Network Device v0.1 May  9 2017 15:44:37 
 +Broadcom GMAC Char Driver v0.1 May  9 2017 15:44:42 Registered<249> 
 +Broadcom GMAC Driver v0.1 May  9 2017 15:44:42 Initialized 
 +fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 
 +ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 
 +fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 
 +ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 
 +fapDrv_psmAlloc: wastage 8 bytes 
 +fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 
 +ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 
 +fapDrv_psmAlloc: wastage 8 bytes 
 +fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 
 +ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 
 +dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered  
 +ewan0: MAC Address: 10:9F:A9:0F:7A:68 
 +eth2: MAC Address: 10:9F:A9:0F:7A:68 
 +eth1: MAC Address: 10:9F:A9:0F:7A:68 
 +eth0: MAC Address: 10:9F:A9:0F:7A:68 
 +JFFS2 notice: (231) check_node_data: wrong data CRC in data node at 0x00263f48: read 0x7d82be45, calculated 0x1f14931d. 
 +Broadcom BCM3168D0 USB Network Device v0.4a May  9 2017 15:43:10 
 +usb0: MAC Address: 10 9F A9 0F 7A 6B 
 +usb0: Host MAC Address: 10 9F A9 0F 7A 6C 
 +USBD Initialization done status 0  
 +hub 1-0:1.0: over-current change on port 2 
 +USB Link DOWN. 
 + 
 +--SMP support 
 +wl: dsl_tx_pkt_flush_len=338 
 +wl: high_wmark_tot=6149 
 +PCI: Setting latency timer of device 0000:00:00.0 to 64 
 +wl: passivemode=1 
 +wl: napimode=0 
 +wl0: allocskbmode=1 currallocskbsz=512 
 +Neither SPROM nor OTP has valid image 
 +wl:srom/otp not programmed, using main memory mapped srom info(wombo board) 
 +wl:loading /etc/wlan/bcm6362_map.bin 
 +srom rev:8 
 +wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=16 
 +wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.7.cpeF2250-36.128L09.0 
 +dgasp: kerSysRegisterDyingGaspHandler: wl0 registered  
 +p8021ag: p8021ag_init entry 
 +-/bin/sh: cmf: not found 
 + 
 +=====FRONTIER  Release Version F2250-36.128L.09/F2250-36.128L.09 (build timestamp 170509_1546) ===== 
 + 
 +smd:error:23.243:initDls:434:Get Board ID F2250 
 +rm: can't remove '/var/dbus/messagebus.pid': No such file or directory 
 +###Tag1 signature(Actiontec),version(F2250-36.128L.02),version2(F2250-36.128L.02),imageSequence(64) 
 +###Tag2 signature(Actiontec),version(F2250-36.128L.09),version2(F2250-36.128L.09),imageSequence(65) 
 +ssk:error:40.391:AEI_rut_addRemoteRemoteGUIRules:2582:ifcName=(null) 
 +ssk:error:40.391:AEI_rut_addRemoteRemoteGUIRules:2595:gwIfName=ppp0 
 +ssk:error:40.401:AEI_rut_addRemoteRemoteGUIRules:2615:wanIpadd= allowedlist=(null) 
 +ssk:error:40.401:AEI_rut_addRemoteRemoteGUIRules:2617:wanIpadd= 
 +ssk:error:40.401:rcl_httpdCfgObject:387: !!! RemoteGui has been disabled!!!  
 + 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables v1.4.0: Unknown arg `--to-ports' 
 +Try `iptables -h' or 'iptables --help' for more information. 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +Device "br0" does not exist. 
 +ssk:error:41.555:rutSys_createHostsFile:1016:fail to get link_local_address of LAN Intf 'br0' 
 +Host MIPS Clock divider pwrsaving is enabled 
 +DDR Self Refresh pwrsaving is enabled 
 +no exist file [/var/autoreservation] error num [2],reason [No such file or directory] 
 +ssk:error:42.076:insertModuleByIndex:454:Failed on command . 
 +ssk:error:42.076:insertModulesWithDep:349:insmod xt_multiport.ko FAILED in insertModuleByIndex() 
 + 
 +Netfilter messages via NETLINK v0.30. 
 +ifconfig: ioctl 0x8913 failed: No such device 
 +WLmngr Daemon is running 
 +optarg=0 shmId=0  
 +killall: wlevt: no process killed 
 +wlevt is ready for new msg... 
 +SIOCSHPNAADMSTATE failed: No such device(19) 
 +*** dslThread dslPid=914 
 +BcmAdsl_Initialize=0xC0293430, g_pFnNotifyCallback=0xC02DBC34 
 +AdslCoreLoadImage: Bonding PHY 
 +lmemhdr[2]=0x10080000, pAdslLMem[2]=0x10080000 
 +pSdramPHY=0xA7FFFFF8, 0x80800040 0x684 
 +*** XfaceOffset: 0x65790 => 0x65790 *** 
 +*** PhySdramSize got adjusted: 0xF9F4C => 0x17F490 *** 
 +AdslCoreSharedMemInit: shareMemSize=2896(2896) 
 +*** XdslCoreHwReset6306 *** 
 +**** SetupReferenceClockTo6306 **** 
 +*** XdslCoreHwReset6306 *** 
 +AdslCoreHwReset:  pLocSbSta=85598000 bkupThreshold=3072 
 +AdslCoreHwReset:  AdslOemDataAddr = 0xA7F63200 
 +***BcmDiagsMgrRegisterClient: 0 *** 
 +dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered  
 +sh: cmf: not found 
 +fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584 
 +XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0 
 +fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456 
 +XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220 
 +bcmxtmrt: PTM/ATM Bonding Mode configured in system  
 +bcmxtmcfg: gulBondDslMonitorValid = 1  
 +*** dslThread dslPid=914 
 +BcmAdsl_Initialize=0xC0293430, g_pFnNotifyCallback=0xC02DBC34 
 +dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered  
 +*** XdslCoreHwReset6306 *** 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +sh: syntax error: unexpected word (expecting ")"
 +sh: syntax error: unexpected "(" 
 +remove file [/var/url_block_enable] error num [2],reason [No such file or directory] 
 +ssk:error:47.572:rcl_wanOpt60Object:373:++++++++newObj->WANOption60=CTL 
 +nf_conntrack version 0.5.0 (1024 buckets, 8192 max) 
 +ssk:error:48.766:ssk_init:1362:dbus-daemon is ready now. 
 + 
 +WPS Device PIN = 14108709 
 +< SES_LED_OFF > 
 +killall: hspotap: no process killed 
 +wlctl: Radio Off 
 +Setting SSID: "Frontier_4278" 
 +Setting SSID: "Guest_4278" 
 +Setting SSID: "Frontier_4278-2" 
 +Setting SSID: "Guest_4278" 
 +Setting SSID: "wl0_Guest4" 
 +wlctl: Unsupported 
 +ifconfig: br1: error fetching interface information: Device not found 
 +ifconfig: br2: error fetching interface information: Device not found 
 +ifconfig: br3: error fetching interface information: Device not found 
 +smd:error:51.485:initDls:434:Get Board ID F2250 
 +PMD: Module entry! 
 +PMD: couldn't get any msg! 
 +PMD: couldn't get any msg! 
 +Broadcom Packet Flow Cache learning via BLOG enabled. 
 +status=00 
 +Note: Loading 6300 MDK (default) driver for 63168 chip  
 +Note: Forcing 53115 driver for 53125  
 +Switch MDK: num_switches = 2 
 +Switch MDK: unit = 0; phy_pbmp = 0x0; config_pbmp = 0x40  
 +Switch MDK link poll thread: unit=1; phypbmp=0xf 
 +iptables v1.4.0: Couldn't find target `urlfilter' 
 + 
 +Try `iptables -h' or 'iptables --help' for more information. 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +captiveEnable=0,webActiveLogEnable=0,webSiteBlockEnable=0 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +iptables: Bad rule (does a matching rule exist in that chain?) 
 +eth0 (switch port: 3) Link UP 100 mbps full duplex 
 +ERROR rtd.c:159 fail to recv msg from msg bus! 
 +ERROR rtd.c:159 fail to recv msg from msg bus! 
 +WARNING tr69_rut_route.c:98 Both PPPConn and IPConn are Disable! 
 +WARNING tr69_rut_route.c:98 Both PPPConn and IPConn are Disable! 
 +ERROR tr69_func_aei_firewall_rules.c:69 gwifname is null 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +ERROR tr69_rut_wan6.c:2176 NOT found wan connection! 
 +</nowiki>
 </WRAP>\\ </WRAP>\\
  
 ==== OpenWrt bootlog ==== ==== OpenWrt bootlog ====
 <WRAP bootlog> <WRAP bootlog>
-<nowiki>COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING</nowiki>+<nowiki>HELO 
 +CPUI 
 +L1CI 
 +HELO 
 +CPUI 
 +L1CI 
 +DRAM 
 +---- 
 +PHYS 
 +STRF 
 +400H 
 +PHYE 
 +DDR2 
 +SIZ4 
 +SIZ3 
 +SIZ2 
 +DINT 
 +USYN 
 +LSYN 
 +MFAS 
 +LMBE 
 +RACE 
 +PASS 
 +---- 
 +ZBSS 
 +CODE 
 +DATA 
 +L12F 
 +MAIN 
 +FPS0 
 +BT64 
 +0002 
 +BT65 
 +0493 
 +NAN3 
 +RFS2 
 +NAN5 
 + 
 + 
 +CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) 
 +Build Date: Tue May  9 15:41:37 PDT 2017 (dqi@dqi-ThinkPad-T430) 
 +Copyright (C) 2000-2011 Broadcom Corporation. 
 + 
 +NAND flash device: name ESMT F59L1G81A, id 0x92f1 block 128KB size 131072KB 
 +External switch id = 53125  
 +Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz 
 +Main Thread: TP0 
 +Memory Test Passed 
 +Total Memory: 134217728 bytes (128MB) 
 +Boot Address: 0xb8000000 
 + 
 +boot load image is: 48 
 +Board IP address                  : 192.168.1.1   
 +Host IP address                   : 192.168.1.100   
 +Gateway IP address                :    
 +Run from flash/host (f/h)         : f   
 +Default host run file name        : vmlinux   
 +Default host flash file name      : bcm963xx_fs_kernel   
 +Boot delay (0-9 seconds)          : 1   
 +Boot image (0=latest, 1=previous) : 0   
 +Board Id (0-38)                   : F2250   
 +Number of MAC Addresses (1-32)    : 8   
 +Base MAC Address                  : 10:9f:a9:0f:7a:68   
 +PSI Size (1-64) KBytes            : 64   
 +Enable Backup PSI [0|1]           : 1   
 +System Log Size (0-256) KBytes    : 64   
 +Main Thread Number [0|1]          : 0   
 +Board Serial Number               : CVYA4070804278   
 +Factory FW Version                : F2250-36.128L.02   
 +WPS PIN                           : 14108709   
 +WPA KEY                           : eqdb8ynghic32e   
 + 
 +This is one CFE built for FRONTIER 2250 
 +*** Press any key to stop auto run (1 seconds) *** 
 +Auto run second count down: 111 
 +CFE>  
 +web info: Waiting for connection on socket 0. 
 + 
 +CFE> ^C 
 +CFE> r 192.168.1.100:/openwrt-bcm63xx-smp-actiontec_f2250-initramfs.elf 
 +0x80a00000/4601294 Entry at 0x80a00000 
 +Closing network. 
 +Disabling Switch ports. 
 +Flushing Receive Buffers... 
 +0 buffers found. 
 +Closing DMA Channels. 
 +Starting program at 0x80a00000 
 + 
 + 
 +OpenWrt kernel loader for BCM63XX 
 +Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org> 
 +Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org> 
 +Copyright (C) 2020 Alvaro Fernandez Rojas <noltari@gmail.com> 
 +Decompressing kernel... done! 
 +blasting from 0x80010000 to 0x00ebde01 (0x80010000 - 0x80ecde10) 
 +Starting kernel at 80010000... 
 + 
 +[    0.000000] Linux version 5.4.174 (bkallus@pistachio) (gcc version 11.2.0 (OpenWrt GCC 11.2.0 r18673+4-b21bc3479d)) #0 SMP Sun Jan 30 04:05:14 2022 
 +[    0.000000] Detected Broadcom 0x63268 CPU revision d0 
 +[    0.000000] CPU frequency is 400 MHz 
 +[    0.000000] 128MB of RAM installed 
 +[    0.000000] board_bcm963xx: Boot address 0xb8000000 
 +[    0.000000] board_bcm963xx: CFE version: 1.0.38-114.185 
 +[    0.000000] printk: bootconsole [early0] enabled 
 +[    0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350) 
 +[    0.000000] board: board name: F2250 
 +[    0.000000] MIPS: machine is Actiontec F2250 
 +[    0.000000] Initrd not found or empty - disabling initrd 
 +[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. 
 +[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes 
 +[    0.000000] Zone ranges: 
 +[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff] 
 +[    0.000000] Movable zone start for each node 
 +[    0.000000] Early memory node ranges 
 +[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff] 
 +[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] 
 +[    0.000000] percpu: Embedded 14 pages/cpu s26896 r8192 d22256 u57344 
 +[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480 
 +[    0.000000] Kernel command line: console=ttyS0,115200 
 +[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) 
 +[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) 
 +[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off 
 +[    0.000000] Memory: 113344K/131072K available (5982K kernel code, 223K rwdata, 1232K rodata, 8680K init, 207K bss, 17728K reserved, 0K cma-reserved) 
 +[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 
 +[    0.000000] rcu: Hierarchical RCU implementation. 
 +[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. 
 +[    0.000000] NR_IRQS: 256 
 +[    0.000000] random: get_random_bytes called from start_kernel+0x35c/0x58c with crng_init=0 
 +[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns 
 +[    0.000013] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns 
 +[    0.008145] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) 
 +[    0.074571] pid_max: default: 32768 minimum: 301 
 +[    0.079656] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) 
 +[    0.087156] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) 
 +[    0.099840] rcu: Hierarchical SRCU implementation. 
 +[    0.105980] smp: Bringing up secondary CPUs ... 
 +[    0.112000] SMP: Booting CPU1... 
 +[    9.188860] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. 
 +[    9.188877] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes 
 +[    9.189148] CPU1 revision is: 0002a080 (Broadcom BMIPS4350) 
 +[    0.175454] Synchronize counters for CPU 1:  
 +[    0.175475] SMP: CPU1 is running 
 +[    0.175494] done. 
 +[    0.205993] smp: Brought up 1 node, 2 CPUs 
 +[    0.220176] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns 
 +[    0.230322] futex hash table entries: 512 (order: 3, 32768 bytes, linear) 
 +[    0.237481] pinctrl core: initialized pinctrl subsystem 
 +[    0.244378] NET: Registered protocol family 16 
 +[    0.254203] unsupported NAND flash detected 
 +[    0.309830] clocksource: Switched to clocksource MIPS 
 +[    0.318821] NET: Registered protocol family 2 
 +[    0.323823] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) 
 +[    0.332519] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear) 
 +[    0.341236] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) 
 +[    0.349154] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear) 
 +[    0.356438] TCP: Hash tables configured (established 1024 bind 1024) 
 +[    0.363399] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) 
 +[    0.370216] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) 
 +[    0.377853] NET: Registered protocol family 1 
 +[    0.382330] PCI: CLS 0 bytes, default 16 
 +[    0.667854] workingset: timestamp_bits=14 max_order=15 bucket_order=1 
 +[    0.695206] squashfs: version 4.0 (2009/01/31) Phillip Lougher 
 +[    0.701258] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. 
 +[    0.722118] bcm63268-pinctrl 100000c0.pin-controller: registered at mmio (ptrval) 
 +[    0.730740] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 13, base_baud = 1562500) is a bcm63xx_uart 
 +[    0.740476] printk: console [ttyS0] enabled 
 +[    0.740476] printk: console [ttyS0] enabled 
 +[    0.749046] printk: bootconsole [early0] disabled 
 +[    0.749046] printk: bootconsole [early0] disabled 
 +[    0.765971] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 88, FIFOs size 542) 
 +[    0.780946] bcm63xx-wdt bcm63xx-wdt:  started, timer margin: 30 sec 
 +[    0.789091] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) 
 +[    0.796233] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) 
 +[    0.803700] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) 
 +[    0.810851] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) 
 +[    0.818003] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) 
 +[    0.828510] NET: Registered protocol family 10 
 +[    0.835549] Segment Routing with IPv6 
 +[    0.839554] NET: Registered protocol family 17 
 +[    0.844148] 8021q: 802.1Q VLAN Support v1.8 
 +[    0.959613] Freeing unused kernel memory: 8680K 
 +[    0.964213] This architecture does not have kernel memory protection. 
 +[    0.970886] Run /init as init process 
 +[    1.017570] random: fast init done 
 +[    1.620880] init: Console is alive 
 +[    1.625100] init: - watchdog - 
 +[    1.663785] kmodloader: loading kernel modules from /etc/modules-boot.d/
 +[    1.702539] usbcore: registered new interface driver usbfs 
 +[    1.708343] usbcore: registered new interface driver hub 
 +[    1.713920] usbcore: registered new device driver usb 
 +[    1.732557] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver 
 +[    1.742341] ehci-fsl: Freescale EHCI Host controller driver 
 +[    1.751462] ehci-platform: EHCI generic platform driver 
 +[    1.877620] ehci-platform ehci-platform: EHCI Host Controller 
 +[    1.883521] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 
 +[    1.892040] ehci-platform ehci-platform: irq 18, io mem 0xb0002500 
 +[    1.937598] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored 
 +[    1.947368] hub 1-0:1.0: USB hub found 
 +[    1.951894] hub 1-0:1.0: 1 port detected 
 +[    1.968150] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver 
 +[    1.976984] ohci-platform: OHCI generic platform driver 
 +[    1.982646] ohci-platform ohci-platform: Generic Platform OHCI controller 
 +[    1.989660] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 
 +[    1.997957] ohci-platform ohci-platform: irq 17, io mem 0xb0002600 
 +[    2.073130] hub 2-0:1.0: USB hub found 
 +[    2.077703] hub 2-0:1.0: 1 port detected 
 +[    2.085030] kmodloader: done loading kernel modules from /etc/modules-boot.d/
 +[    2.103467] init: - preinit - 
 +[    2.548874] random: jshn: uninitialized urandom read (4 bytes read) 
 +[    2.633083] random: jshn: uninitialized urandom read (4 bytes read) 
 +[    2.704947] random: jshn: uninitialized urandom read (4 bytes read) 
 +Press the [f] key and hit [enter] to enter failsafe mode 
 +Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level 
 +[    7.149261] procd: - early - 
 +[    7.152692] procd: - watchdog - 
 +[    7.742976] procd: - watchdog - 
 +[    7.748717] procd: - ubus - 
 +[    7.768184] urandom_read: 3 callbacks suppressed 
 +[    7.768197] random: ubusd: uninitialized urandom read (4 bytes read) 
 +[    7.803490] random: ubusd: uninitialized urandom read (4 bytes read) 
 +[    7.810715] random: ubusd: uninitialized urandom read (4 bytes read) 
 +[    7.821807] procd: - init - 
 +Please press Enter to activate this console. 
 +[    8.782949] kmodloader: loading kernel modules from /etc/modules.d/
 +[    9.034253] PPP generic driver version 2.4.2 
 +[    9.044664] NET: Registered protocol family 24 
 +[    9.071309] kmodloader: done loading kernel modules from /etc/modules.d/
 +[    9.190830] urngd: v1.0.2 started. 
 +[    9.535315] crng init done 
 +[    9.538117] random: 1 urandom warning(s) missed due to ratelimiting 
 + 
 + 
 + 
 +BusyBox v1.35.0 (2022-01-30 04:05:14 UTC) built-in shell (ash) 
 + 
 +  _______                     ________        __ 
 +       |.-----.-----.-----.|  |  |  |.----.|  |_ 
 +     ||  _  |  -__|     ||  |  |  ||   _||   _| 
 + |_______||   __|_____|__|__||________||__|  |____| 
 +          |__| W I R E L E S S   F R E E D O M 
 + ----------------------------------------------------- 
 + OpenWrt SNAPSHOT, r18673+4-b21bc3479d 
 + ----------------------------------------------------- 
 +=== WARNING! ===================================== 
 +There is no root password defined on this device! 
 +Use the "passwd" command to set up a new password 
 +in order to prevent unauthorized SSH logins. 
 +-------------------------------------------------- 
 +root@OpenWrt:/# </nowiki>
 </WRAP>\\ </WRAP>\\
  
  • Last modified: 2022/01/30 21:12
  • by kenballus