Adding OpenWrt support for Teles VoIPBox DSL (Lantiq VR9)

Hello everyone,

I recently rescued some routers from being scrapped and am now trying to port OpenWRT to them. These are IADs from Teles of the type VoIPBox DSL.

The hardware sounds quite promising for a simple router or modem:

  • Lantiq VRX288 AVDSL
  • 64 MiB DRAM
  • 32 MiB Flash
  • 2 GigE ports
  • No Wifi
  • 4 ISDN BRI ports (HFC) - I don't care about them.

The bootloader is U-Boot. I have a uImage available that I can flash via U-Boot using TFTP to restore the original software.

I have identified the console port on the board and can log in as root.

The proprietary operating system is based on OpenWrt Backfire 10.03.1. The manufacturer has added the Lantiq drivers and some kernel modules for ISDN.

I have stored the bootlog, pictures and other information in Google Drive:
https://drive.google.com/drive/folders/1atemnNVjSJ318mOuI_GoT-HpqK2dMlZV?usp=sharing

I have tried to read into OpenWRT over the last few days and at least create a basic configuration for the device, but I am finding it very difficult to understand. Unfortunately I don't have access to the original sources for OpenWrt Backfire 10.03.1 for the device, so I don't have a good base to start from. I've managed to add the partitions, but I'm already at a loss when it comes to connecting the Ethernet ports. I thought it couldn't be that difficult without Wifi, but I was wrong ;-).

Is there anyone who would like to support me here? I am grateful for any help.

I would suggest starting with similar VR9 based devices already supported by OpenWrt like e.g. the BT Home Hub 5A.

Start with documenting whatever you can (most importantly flash partitioning) and backing up everything, once you have serial console access you can start hacking with initramfs images over tftp (if the vendor u-boot supports it) - ideally you also identify Boot_SEL2.

Thank you very much for your answer. I have already looked at all the implemented VR9 devices, but I have not found any device that is similar. In another post here in the forum I found the hint that the chipset supports either 4 FE or 2 GE ports. Since my units only have 2 GE ports, I assume that these are directly the 2 GE ports of the chipset - I can't see a switch chip on the PCB either. However, I have no idea how I have to define this in the dts file.

Thanks, slh. I've documented everything I'm aware of in the Google Drive folder linked above.

What I don't understand: Which partitions do I have to mark as read-only and which not? Why, for example, is the "firmware" partition not marked as read-only on most devices, as it only contains the Lantiq drivers?

In which partition does OpenWRT store the overlay FS?

I'll try booting over tftp and let you know...

Adding basic support should be easy - this appears to be VRX288 SoC with VRX208 xDSL chipset. Start with minimal device tree that includes vr9.dtsi and defines the bootargs, memory size and NOR flash, and work your way up. From what I found, even the XHFC ISDN chip should be supported in Linux.

Regarding the partition layout, can you post the output of printenv and mtdparts in U-Boot? The boot log alone is a little bit mysterious about the process of finding and loading the kernel.

Thanks - yes, I'm trying to add a basic configuration to start with. Hopefully I'll have some success later this day...

I'm sorry, I forgot to upload u-boot information to google drive, I've added a u-boot.txt file now. There's no mtdparts command in u-boot.

Thanks. Of course, they had to be special and append kernel to the end of the rootfs instead of having a dedicated partition.

Here's how I'd do it for testing purposes: name the 6 MiB "rootfs" partition as "kernel" in the device tree, and 24 MiB data_vol should be named "ubi". That way, OpenWrt's sysupgrade will use the smaller partition for kernel, and create an ubifs partition in the larger one which will be split between squashfs rootfs and overlay - that should give you 20-ish MiB of free space. That's the standard way of flashing OpenWrt.
After that, you have kernel_addr and f_kernel_addr that you should set to 0xb0140000, f_kernel_size that should be set to the size of the uImage, and f_kernel_crc that appears to be CRC checksum of the uImage.

Ideally, setting kernel_size to the beginning of that partiton would be a one-time job and bootloader doesn't check the size and CRC variables. If it does, you'd either have to implement calculation of those values in sysupgrade, or, even better, if you have a usable source code, modify the U-Boot to have a more sane boot process than the current one.

Last thing (I think), can you post the output of mount command in the root shell?

Thank you! I must admit that I didn't understand everything you explained, but I'll look at it step by step now.

Here's the output of mount command:

root@TAG99014188200450:~# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
none on /sys type sysfs (rw,relatime)
/dev/ram on /ramdisk type ramfs (rw,relatime,nr_inodes=1k,mode=770)
/dev/ram on /dev type ramfs (rw,relatime)
none on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
/dev/mtdblock6 on /boot type jffs2 (rw,relatime)
/dev/mtdblock2 on /lib/firmware/2.6.32.42 type squashfs (ro,relatime)
mountd(pid829) on /ramdisk/usb/.run/mountd type autofs (rw,relatime,fd=5,pgrp=828,timeout=60,minproto=5,maxproto=5,indirect)
/dev/ram on /home/teles type ramfs (rw,relatime,nr_inodes=1k,mode=770)
root@TAG99014188200450:~#

/boot is where the configuration files are located and where I can put an update.img file into which gets picked up and flashed by u-boot on reboot. This is the regular update procedure.

Simply, when you're defining the NOR partition layout in device tree, just copy all offsets and sizes, but rename "rootfs" partition to "kernel" and "data_vol" to "ubi". Then modify kernel_addr and f_kernel_addr in U-Boot to 0xb0140000 (with setenv/saveenv).

Nice, more "special" stuff :slight_smile: So this device doesn't have an upgrade mechanism in the OS and relies exclusively on U-Boot for flashing?

OK, yes, I've done that.

Yes, I think so. This is a box solely used and managed by ISP to provide ISDN service to customers, so all management is done by the ISP. Teles offers a management system (NMS) where all boxes connect to after booting. The NMS rolls out software updates as well by copying new update.img files to the boxes.

OK, that was a long day and an even longer night :wink:

I've built a "openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-initramfs-kernel.bin" file which boots successfully. I've added a bootlog and some more information to my google drive (subfolder 2021-04-05).

  • Ethernet links come up, but there is no eth device per port - is this ok / by design?

  • MAC address is taken from u-boot env => OK

  • Front LEDs are working as expected => OK

  • Ethernet Port LEDs functionality has changed: Old Teles Firmware and U-Boot use two LEDs per port (link/traffic), OpenWRT uses only one LED per port (on = link, flickering = traffic). I've seen some dts files with LED definitions for ethernet/gphy, but I've no clue how to adopt them for my device. I can't find any documentation on this? => solved, see below => OK

  • DSL comes up, but DSL firmware is too old, doesn't support ADSL annex J and perhaps VDSL vectoring. I've extracted DSL firmware from FRITZ!Box 7490 firmware 7.21, but I don't know how to replace the existing package with the new files.

  • I had two unexpected reboots - no message, no crash.

  • How to build a uImage and store it on flash? Booting from TFTP Server is great for development, but... :wink:

Sorry, so many questions, but I'm very happy with the results so far :slight_smile:

Solved - Docs: https://lwn.net/Articles/688391/

I'm still struggling with this issue. After make, I've got the file openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-initramfs-kernel.bin in /bin/targets/lantiq/xrx200 for tftp booting, but no other binary files. I'm not sure why?

This is my device definition so far:

define Device/teles_voipbox-dsl-bri
  $(Device/lantiqFullImage)
  DEVICE_VENDOR := Teles
  DEVICE_MODEL := VoIPBox DSL 2/4/8
endef
TARGET_DEVICES += teles_voipbox-dsl-bri

Is IMAGE_SIZE or KERNEL_SIZE needed? I can't find any documentation regarding these settings. What's the purpose of these lines?

OK, I've added

IMAGE_SIZE := 6656k

because of this partition layout:

                        partition@140000 {
                                label = "kernel";
                                reg = <0x140000 0x680000>; /* 6.8 MB */
                        };

Now I've got the following files:

2271450 5108 -rw-r--r--  1 jbr jbr 5229002 Apr 11 17:12 openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-initramfs-kernel.bin
2271321 5196 -rw-r--r--  1 jbr jbr 5318638 Apr 11 17:11 openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-squashfs-fullimage.bin
2271322 5380 -rw-r--r--  1 jbr jbr 5505842 Apr 11 17:11 openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-squashfs-sysupgrade.bin

Did I do that right?

IMAGE_SIZE limits the maximum size the image might grow, it doesn't pad the image to size (which might be needed for factory images, but isn't for sysupgrade ones).

If your image size ever exceeds that value, the buildsystem will discard the oversized image to avoid damage.

OK... I'm still struggling with this.

This is my partition layout as suggested by @ danijeltudek:

&localbus {
        nor@0 {
                compatible = "lantiq,nor";
                bank-width = <2>;
                reg = <0 0x0 0x2000000>;
                #address-cells = <1>;
                #size-cells = <1>;

                partitions {
                        compatible = "fixed-partitions";
                        #address-cells = <1>;
                        #size-cells = <1>;

                        partition@0 {
                                label = "uboot";
                                reg = <0x0 0x20000>; /* 128 kB */
                                read-only;
                        };

                        partition@20000 {
                                label = "gphy_firmware";
                                reg = <0x20000 0x20000>; /* 128 kB */
                                read-only;
                        };

                        partition@40000 {
                                label = "firmware";
                                reg = <0x40000 0x100000>; /* 1 MB */
                                read-only;
                        };

                        partition@140000 {
                                label = "kernel";
                                reg = <0x140000 0x680000>; /* 6.8 MB */
                        };

                        partition@7c0000 {
                                label = "sysconfig";
                                reg = <0x7c0000 0x20000>; /* 128 kB */
                                read-only;
                        };

                        partition@7e0000 {
                                label = "ubootconfig";
                                reg = <0x7e0000 0x20000>; /* 128 kB */
                                read-only;
                        };
                        partition@800000 {
                                label = "ubi";
                                reg = <0x800000 0x1800000>; /* 25 MB */
                        };
                };
        };
};

So kernel should be used for kernel only and ubi should be split for rootfs and overlay.

As the image is split into two partitions, I still don't know what to set IMAGE_SIZE to. I've set it to the size of the kernel partition and it compiles, is this OK? Or is this too small because it doesn't respect the rootfs in ubi partition? And what is KERNEL_SIZE for? Do I need it?

Booting OpenWrt using tftpboot is OK, LEDs and Ethernet are working, even the mac address is set correctly.

Then I've tried to flash a fullimage and boot into it. I've tried a lot, but I'm not successful: The rootfs cannot be found. I've tried to set setenv addmisc 'setenv bootargs $(bootargs) console=$(console),$(baudrate) root=1f06 rootfstype=squashfs', but that doesn't change anything.

[    0.527455] 7 fixed-partitions partitions found on MTD device ltq_nor
[    0.533821] Creating 7 MTD partitions on "ltq_nor":
[    0.538684] 0x000000000000-0x000000020000 : "uboot"
[    0.545853] 0x000000020000-0x000000040000 : "gphy_firmware"
[    0.552326] 0x000000040000-0x000000140000 : "firmware"
[    0.559408] 0x000000140000-0x0000007c0000 : "kernel"
[    0.564658] 0x0000007c0000-0x0000007e0000 : "sysconfig"
[    0.570873] 0x0000007e0000-0x000000800000 : "ubootconfig"
[    0.577238] 0x000000800000-0x000002000000 : "ubi"
[    0.585536] libphy: Fixed MDIO Bus: probed
[    0.598497] NET: Registered protocol family 10
[    0.605986] Segment Routing with IPv6
[    0.608325] NET: Registered protocol family 17
[    0.612898] 8021q: 802.1Q VLAN Support v1.8
[    0.730229] libphy: lantiq,xrx200-mdio: probed
[    0.735996] net-xrx200: invalid MAC, using random
[    0.740358] Intel XWAY PHY11G (xRX v1.2 integrated) 0:11: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:11, irq=POLL)
[    0.754241] Intel XWAY PHY11G (xRX v1.2 integrated) 0:13: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:13, irq=POLL)
[    0.769522] UBI error: no valid UBI magic found inside[    0.774965] /dev/root: Can't open blockdev
[    0.777713] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.785141] Please append a correct "root=" boot option; here are the available partitions:
[    0.793522] 1f00             128 mtdblock0
[    0.793529]  (driver?)
[    0.799988] 1f01             128 mtdblock1
[    0.799996]  (driver?)
[    0.806582] 1f02            1024 mtdblock2
[    0.806589]  (driver?)
[    0.813041] 1f03            6656 mtdblock3
[    0.813048]  (driver?)
[    0.819572] 1f04             128 mtdblock4
[    0.819579]  (driver?)
[    0.826147] 1f05             128 mtdblock5
[    0.826154]  (driver?)
[    0.832628] 1f06           24576 mtdblock6
[    0.832635]  (driver?)
[    0.839214] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.847439] Rebooting in 1 seconds..

I use the same mechanism here as Teles flashes a FullImage. Is that OK? The kernel seems to be in the right place, but how can I check whether the rootfs is also in the ubi partition?

This is the beginning of the partition:

root@OpenWrt:/# cat /dev/mtd6ro | hexdump -C
00000000  19 85 20 03 00 00 00 0c  f0 60 dc 98 19 85 e0 02  |.. ......`......|
00000010  00 00 00 f5 18 89 a1 24  00 00 00 9b 00 00 00 1d  |.......$........|
00000020  00 00 81 fd 01 f4 00 64  00 00 63 26 55 c3 48 58  |.......d..c&U.HX|
00000030  55 c3 48 58 00 00 00 0a  00 00 2e 8a 00 00 00 b1  |U.HX............|
00000040  00 00 01 76 06 00 00 00  bb 9b 43 99 9f 01 4a 97  |...v......C...J.|
00000050  78 5e ac 8e 31 0e 83 30  0c 45 67 7c 0a 0f 0c ed  |x^..1..0.Eg|....|
00000060  40 72 80 1e a5 ea 10 48  28 11 21 09 24 11 ad aa  |@r.....H(.!.$...|
00000070  de bd 2e a2 40 f6 7a b1  fc 6c ff ff 47 c0 b5 8c  |....@.z..l..G...|
00000080  13 b2 c7 f2 81 e5 73 63  d3 40 80 f5 0e 8a 46 62  |......sc.@....Fb|
00000090  b5 62 65 74 8b 57 ac 5a  64 dc c4 91 d3 85 c3 1b  |.bet.W.Zd.......|
000000a0  5e 30 76 ca 6e af 8d 3f  ae 19 14 a4 b5 df 67 ae  |^0v.n..?......g.|
000000b0  c2 fb cc b7 d5 cb 7a 69  d2 59 05 6f 80 6f 3a 13  |......zi.Y.o.o:.|
000000c0  d5 dd d5 fa 74 86 17 05  fa e9 13 4d 9e 85 6e 55  |....t......M..nU|
000000d0  a7 51 ba d9 66 60 96 d9  18 a2 88 29 ec 48 44 e4  |.Q..f`.....).HD.|
000000e0  93 18 a4 0e 3d 4f 61 e2  b5 b6 87 b8 ff d0 07 ca  |....=Oa.........|
000000f0  fb 11 40 30 f7 96 16 27  e9 02 04 18 00 6a 9c 6d  |..@0...'.....j.m|
00000100  aa ff ff ff 19 85 e0 02  00 00 04 a7 f9 80 54 f8  |..............T.|
00000110  00 00 00 9b 00 00 00 1e  00 00 81 fd 01 f4 00 64  |...............d|
00000120  00 00 63 26 55 c3 48 58  55 c3 48 58 00 00 00 0a  |..c&U.HXU.HX....|
00000130  00 00 30 00 00 00 04 63  00 00 10 00 06 00 00 00  |..0....c........|
00000140  b5 28 c0 86 01 32 bd 0c  78 5e dc 57 df 6f db 36  |.(...2..x^.W.o.6|
00000150  10 7e 16 ff 8a ab 62 0c  ed 43 2c d7 4d bb 01 ad  |.~....b..C,.M...|
00000160  f7 d0 cc 4e 83 61 4b 50  c7 68 81 61 50 64 89 b2  |...N.aKP.h.aPd..|
00000170  b9 c8 a4 22 52 b1 8d 61  ff fb 8e a4 7e 59 96 93  |..."R..a....~Y..|
00000180  18 1d f6 d0 04 51 24 de  f1 ee d3 dd 77 77 94 a4  |.....Q$.....ww..|
00000190  19 0b 92 fe 9d 80 be 97  a8 7b 2f 97 73 4e 55 fd  |.........{/.sNU.|
000001a0  7c 21 e6 6c da d2 d1 6b  bf 5b 25 2f 0b 56 11 93  ||!.l...k.[%/.V..|
000001b0  77 5e c2 e6 c4 c9 56 b5  95 53 f9 4d 96 89 13 2e  |w^....V..S.M....|
000001c0  57 22 82 1f cf ce 6a 27  b9 cc bc 39 e3 08 94 e6  |W"....j'...9....|
000001d0  69 5f 2e 3b 25 91 58 f3  43 b2 75 74 48 22 55 a0  |i_.;%.X.C.utH"U.|
000001e0  72 d9 29 0d 14 21 61 a0  e0 c3 07 f0 c7 57 13 f8  |r.)..!a......W..|
000001f0  b9 c3 ad 08 22 1f 51 e1  7e 72 f2 c2 60 c4 bb d5  |....".Q.~r..`...|
00000200  1d c7 37 f0 22 fa e0 dd  87 f7 2b 36 80 10 86 67  |..7.".....+6...g|

This is what binwalk lists for a teles "totalimage" and an OpenWrt "fullimage":

jbr@ubuntu:~/21.2.1.0$ binwalk totalimage_bri.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0xDC91753F, created: 2015-08-06 11:35:35, image size: 7402600 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xC83FDE41, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: none, image name: "VR9 Totalimage"
72            0x48            uImage header, header size: 64 bytes, header CRC: 0x11E93352, created: 2015-08-06 11:35:35, image size: 131072 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x1AA4043F, OS: Linux, CPU: MIPS, compression type: lzma, image name: "U-Boot Img"
11464         0x2CC8          CRC32 polynomial table, little endian
12748         0x31CC          uImage header, header size: 64 bytes, header CRC: 0x236144BE, created: 2015-08-06 11:33:56, image size: 79408 bytes, Data Address: 0xA0400000, Entry Point: 0xA0400000, data CRC: 0x4A23FEC0, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
12812         0x320C          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 241944 bytes
131208        0x20088         uImage header, header size: 64 bytes, header CRC: 0x99727732, created: 2015-08-06 11:35:35, image size: 131072 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xD086682B, OS: Linux, CPU: MIPS, compression type: lzma, image name: "UBootEnv Img"
262344        0x400C8         uImage header, header size: 64 bytes, header CRC: 0xBF031FB7, created: 2015-08-06 11:35:35, image size: 49152 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xACC77BF2, OS: Linux, CPU: MIPS, compression type: lzma, image name: "gphy_firmware"
262408        0x40108         uImage header, header size: 64 bytes, header CRC: 0x9DC88B76, created: 2014-05-05 10:33:08, image size: 41646 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xE4D70E0A, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "GPHY Firmware"
262480        0x40150         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 131200 bytes
311560        0x4C108         uImage header, header size: 64 bytes, header CRC: 0xC6EC563F, created: 2015-08-06 11:35:32, image size: 4817760 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x5DBAC87F, OS: Linux, CPU: MIPS, image type: Filesystem Image, compression type: lzma, image name: "LTQCPE RootFS"
311624        0x4C148         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 4817754 bytes, 1456 inodes, blocksize: 131072 bytes, created: 2015-08-06 11:35:32
5129384       0x4E44A8        uImage header, header size: 64 bytes, header CRC: 0xCE5D511A, created: 2015-08-06 11:35:18, image size: 1384320 bytes, Data Address: 0x80002000, Entry Point: 0x800061F0, data CRC: 0x944C7298, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS LTQCPE Linux-2.6.32.42"
5129448       0x4E44E8        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4474176 bytes
6513768       0x636468        uImage header, header size: 64 bytes, header CRC: 0x53C5C297, created: 2015-08-06 11:35:33, image size: 888832 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xAB8BAF8B, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "VR9 Firmware"
6513832       0x6364A8        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 888027 bytes, 4 inodes, blocksize: 131072 bytes, created: 2015-08-06 11:35:33
jbr@ubuntu:~/openwrt/bin/targets/lantiq/xrx200$ binwalk openwrt-lantiq-xrx200-teles_voipbox-dsl-bri-squashfs-fullimage.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x25AC4088, created: 2021-04-11 17:09:29, image size: 5318574 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xEF7F963B, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: none, image name: "OpenWrt fullimage"
72            0x48            uImage header, header size: 64 bytes, header CRC: 0x18565707, created: 2021-04-11 17:09:29, image size: 2497803 bytes, Data Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0x54813998, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-5.4.109"
136           0x88            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 8061386 bytes
2497940       0x261D94        uImage header, header size: 64 bytes, header CRC: 0x665CA3E1, created: 2021-04-11 17:09:29, image size: 2820634 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xE2A2DD0D, OS: Linux, CPU: MIPS, image type: Filesystem Image, compression type: lzma, image name: "OpenWrt RootFS"
2498004       0x261DD4        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2820634 bytes, 903 inodes, blocksize: 262144 bytes, created: 2021-04-11 17:09:29

Once again I've added logs to my Google Drive Folder (see folder 2021-04-17):
https://drive.google.com/drive/folders/1atemnNVjSJ318mOuI_GoT-HpqK2dMlZV?usp=sharing

This should be root=/dev/mtdblock6.
Set KERNEL_SIZE to the size of kernel partition (6656k) and IMAGE_SIZE to the sum of kernel and ubi partition sizes. For reference, see how other boards have it set in target/linux/lantiq/image/vr9.mk.

Ah, I see, yes, makes sense. So I've added:

define Device/teles_voipbox-dsl-bri
  $(Device/lantiqFullImage)
  DEVICE_VENDOR := Teles
  DEVICE_MODEL := VoIPBox DSL 2/4/8
  KERNEL_SIZE := 6656k
  IMAGE_SIZE := 31232k
endef
TARGET_DEVICES += teles_voipbox-dsl-bri

The build is successful.

root=1f06 and root=/dev/mtdblock6: I've tried both, there's no difference. Both fail. I've tried changing addmisc env and adding it to the .dts file:

        chosen {
                bootargs = "console=ttyLTQ0,115200 root=/dev/mtdblock6";
        };
[    0.769198] UBI error: no valid UBI magic found insid[    0.775381] List of all partitions:
[    0.777568] 1f00             128 mtdblock0
[    0.777577]  (driver?)
[    0.783953] 1f01             128 mtdblock1
[    0.783960]  (driver?)
[    0.790543] 1f02            1024 mtdblock2
[    0.790551]  (driver?)
[    0.797012] 1f03            6656 mtdblock3
[    0.797019]  (driver?)
[    0.803605] 1f04             128 mtdblock4
[    0.803612]  (driver?)
[    0.810133] 1f05             128 mtdblock5
[    0.810140]  (driver?)
[    0.816593] 1f06           24576 mtdblock6
[    0.816599]  (driver?)
[    0.823154] No filesystem could mount root, tried:
[    0.823163]  squashfs
[    0.828047]
[    0.831736] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,6)
[    0.840115] Rebooting in 1 seconds..

So I assume the rootfs is not written to the ubi partition by the teles update tool.

What about booting the initramfs file and using the sysupgrade.bin file to flash OpenWrt? I didn't try this yet, don't want to brick the device :wink: .

It's 101% percent likely that vendor's update procedure isn't aware of ubi partition and squashfs/jffs2 split. You must boot initramfs and use OpenWrt's sysupgrade. Also, knowing that now, you can probably drop the root= from kernel command line.