Kernel, Toolchain ... of Xiaomi Router R1D
Switch branches/tags
Nothing to show
Clone or download
comcat doc: update the readme to make sure users use correct lzma
lzma is symbolic link to xz in new ubuntu system. This make
the kernel build system generate the vmlinuz without file size
in header. The CFE can not extract the kernel and say:

	PANIC: out of memory!

Signed-off-by: Jack Tan <>
Latest commit c77e267 Jul 21, 2015
Type Name Latest commit message Commit time
Failed to load latest commit information.


        Xiaomi Router Board Support Package

1. Overview

Chinese version please refer to the

Support Xiaomi R1D router (with 1T sata disk).

The Kernel version is 2.6.36
WLAN driver are binary object file from Broadcom located in 'drivers/net/wl'

This BSP is validated in following environment:

 * CFE version: v1.0.4 / Build Date: Wed Apr 30 18:03:21 CST 2014

If you meet some kernel loading issue plase degrade the firmware to 0.4.85
which is with this CFE version.

2. Change History

  - 2014/06: First version with kernel 2.6.36, support Xiaomi router R1D

3. Features

3.1 Supported Features

  o General Platform
    + ARM Cortex A9 Dual-Core
    + 32 KB I-cache and 32 KB D-cache per core
    + 256 KB L2 Cache (shared)
    + 128-entry TLB
    + SMP

  o Bus
    + DDR3: Broadcom BCM4709 On-Chip DDR3 interface
    + PCI-E: Broadcom BCM4709 On-Chip PCI-E Controller 
    + USB: Broadcom BCM4709 On-Chip USB Controller
    + SPI: Broadcom BCM4709 On-Chip SPI Controller
    + SATA: ASMedia ASM1062 PCI-E SATA Controller

  o Network
    + Ethernet: Broadcom On-Chip 010/100/1000M  Ethernet Controller 
    + WLAN:
        + 2.4GHz: BCM43217, 802.11b/g/n Transceiver, PCIe 2.0 interface,
                   Radio + Baseband + MAC, 300Mbps
        + 5.0GHz: BCM4352, 2-Stream 802.11ac Transceiver (Support 802.11a/b/g/n)
                   PCIe 2.0 interface, Radio + Baseband + MAC, 867Mbps

  o Storage
    + NOR Flash: MXIC 25L12835F (16MB)
    + SATA Disk: Samsung 1T Sata disk 

  o MISC
    + Temp Sensor: TMP75
    + LED: Three LEDs (red, yellow, blue), GPIO interface

3.2 Unsupported Features

Will be support in the furture:

  o MISC
    + PWM

4. Test Instructions

We suggest you to try the kernel and rootfs through TFTP and NFS. These are not
affect the original ROM system. 

You can flush the kernel image into the flash and unpack the rootfs into the
/dev/sda4 via following Section 5 instructions after you are sure that the
system is OK.

4.1 Build

The following is validated in Ubuntu 12.04:

  $ sudo apt-get install lzma

Please make sure the version of lzma is:

  $ lzma --version
  LZMA command line tool 9.22
  LZMA SDK 9.22

  $ git clone git://
  $ cd miwifi/
  $ make

The output kernel image is vmlinuz, you can load it in CFE via tftpboot directly

The rootfs is located at miwifi/rootfs/

The root password is 'admin'

The wireless SSID is 'Jarvis' and 'Jarvis_5G' and the password is 'qwer1234'

4.2 Prepare the NFS Rootfs

4.2.1 Prepare the NFS Server

If you want to use the NFS as the root fs. You need to setup a NFS server
in you PC:

$ sudo apt-get install nfs-kernel-server

Config the nfs directory:

$ sudo mkdir -p /tftpboot/rootfs
$ cat /etc/exports
/tftpboot/rootfs    *(async,rw,insecure,insecure_locks,no_root_squash)

Restart the nfs server:

$ sudo /etc/init.d/nfs-kernel-server restart

Testing the nfs server:

$ sudo mount -t nfs /mnt

4.2.2 Link the Rootfs

$ sudo rm -rf /tftpboot/rootfs
$ sudo ln -sf /path/to/miwifi/rootfs /tftpboot/rootfs
$ sudo /etc/init.d/nfs-kernel-server restart

4.2.3 Setup the nvram

Set the nvram varible 'rootfs' to 'nfs', then the kernel would be mount the as the root fs:

root@XiaoQiang:/# nvram get rootfs
root@XiaoQiang:/# nvram set rootfs=nfs
root@XiaoQiang:/# nvram commit

Then after the kernel bootup, it will be mount the /tftpboot/rootfs as the
root fs.

4.3 Boot kernel

4.3.1 Prepare Network

Make sure the LAN port (black one) of the Router and your PC ethernet port are
connected to the same Ethernet HUB.

Make sure the WAN port (blue one) of the Router is connected to the local

The default ip addr of the CFE is and the default tftp server ip is So we need to setup a new ip for your PC eth0 port something like:

  $ sudo ifconfig eth0:0
  $ sudo ifconfig eth0:1

4.3.2 Setup TFTP Server

We load the kernel through tftpboot. So we need to install a tftp server in your
desktop PC:

  $ sudo apt-get install tftpd tftp

Configure the tftp server via touching a file /etc/xinetd.d/tftp with following

$ cat /etc/xinetd.d/tftp
service tftp
    socket_type = dgram
    protocol = udp
    wait = yes
    user = root
    server = /usr/sbin/in.tftpd
    server_args = -s /tftpboot
    disable = no
    per_source = 11
    cps = 100 2
    flags = IPv4

$ ls /etc/xinetd.d/
chargen  daytime  discard  echo  tftp  time

$ sudo mkdir /tftpboot
$ sudo chmod 777 /tftpboot

$ sudo /etc/init.d/xinetd restart

Now you can place your vmlinuz into the /tftpboot:

$ cp /path/to/miwifi/vmlinuz /tftpboot/

4.3.3 Load kernel in CFE

You need to set the nvram parameter 'flag_tftp_bootup' to 'on' to make the
CFE to load the vmlinuz through tftp from tftp server:

root@XiaoQiang:/# nvram get flag_tftp_bootup
root@XiaoQiang:/# nvram set flag_tftp_bootup=on
root@XiaoQiang:/# nvram commit
root@XiaoQiang:/# nvram get flag_tftp_bootup
root@XiaoQiang:/# reboot
CFE version v1.0.4
BSP: (r415984) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Wed Apr 30 18:03:21 CST 2014 (szy@shenzhiyong-ct)
Device eth0:  hwaddr 8C-BE-BE-20-B7-48, ipaddr, mask
        gateway not set, nameserver not set
********** flag_tftp_bootup=on **********
tftp network: ifconfig eth0 -addr= -mask= -gw=
Device eth0:  hwaddr 8C-BE-BE-20-B7-48, ipaddr, mask
        gateway, nameserver not set
kernel: boot -raw -z -addr=0x8000 -max=0x800000
Loader:raw Filesys:tftp Dev:eth0 File: Options:(null)
Loading: ........ 5704544 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000

5. Flush Instructions

If the kernel and rootfs are stable (via TFTP and NFS to test) you can try to
flush the kernel into the flash and deploy the rootfs into /dev/sda4

5.1 Build

The following is validated in Ubuntu 12.04:

  $ sudo apt-get install lzma
  $ git clone git://
  $ cd miwifi/
  $ make nonfs

The output kernel image is vmlinuz.trx less than 3MB. It can be flushed into the

The rootfs is jarvis-rootfs.tgz

The root password is 'admin'

The wireless SSID is 'Jarvis' and 'Jarvis_5G' and the password is 'qwer1234'

5.2 Deploy kernel and rootfs

Copy the kernel and rootfs into the router:

  $ scp vmlinuz.trx root@
  root@'s password:
  $ scp jarvis-rootfs.tgz root@
  root@'s password:

login in the router via SSH, and deploy the rootfs into sda4:

  root@XiaoQiang:/# mount | grep userdisk
  /dev/sda4 on /userdisk type ext4 (rw,noatime,barrier=1,data=ordered)
  root@XiaoQiang:/# tar zxpf /userdisk/jarvis-rootfs.tgz -C /userdisk/

Deply the kernel into /dev/mtd2 (flash.os2 in CFE):

  root@XiaoQiang:/# cat /proc/mtd
  dev:    size   erasesize  name
  mtd0: 00040000 00010000 "boot"
  mtd1: 00300000 00010000 "os"
  mtd2: 00300000 00010000 "os1"
  mtd3: 00890000 00010000 "squashfs"
  mtd4: 00010000 00010000 "crash"
  mtd5: 00100000 00010000 "overlay"
  mtd6: 00010000 00010000 "board_data"
  mtd7: 00010000 00010000 "nvram"
  mtd8: 00fe0000 00010000 "firmware"
  root@XiaoQiang:/# mtd write /userdisk/vmlinuz.trx os1
  Unlocking os1 ...
  Writing from /userdisk/vmlinuz.trx to os1 ...     

5.3 Setup the nvram

The nvram variable 'flag_last_success' can affect the CFE loading kernel activity.

If the flag_last_success = 0, CFE would be load the kernel from flash.os1 (mtd1)
If the flag_last_success = 1, CFE would be load the kernel from flash.os2 (mtd2)

  root@XiaoQiang:/# nvram set flag_tftp_bootup=off        # turn off the tftp
  root@XiaoQiang:/# nvram get flag_last_success
  root@XiaoQiang:/# nvram set flag_last_success=1         # load kernel from mtd2
  root@XiaoQiang:/# nvram set rootfs=sata
  root@XiaoQiang:/# nvram commit

6. APP build 

Install an ARM basic debian on your x86 machine, The following is validated in
Ubuntu 12.04:

  $ sudo apt-get install qemu-user-static

 And create the core rootfs with the included debootstrap wrapper script:

  $ sudo qemu-debootstrap --arch armel stable rootfs
  I: Running command: debootstrap --arch armel --foreign stable rootfs
  I: Retrieving Release
  I: Retrieving Packages
  I: Validating Packages
  I: Base system installed successfully.

The basic debian successfully created in rootfs directory. Now you can chroot
into the rootfs:

  $ sudo chroot ./rootfs

  # ldd bin/bash => /lib/arm-linux-gnueabi/ (0xf67af000) => /lib/arm-linux-gnueabi/ (0xf67a4000) => /lib/arm-linux-gnueabi/ (0xf677a000) => /lib/arm-linux-gnueabi/ (0xf6642000)
  /lib/ (0xf6fda000)

  # cd bin
  # ls -l sh
  lrwxrwxrwx 1 root root 4 Mar  1  2012 sh -> dash
  # ln -sf bash sh
  # ls -l sh
  lrwxrwxrwx 1 root root 4 Jul  2 11:59 sh -> bash

  # cat etc/apt/sources.list
  deb   wheezy main contrib non-free

  # apt-get update
  Get:1 wheezy Release.gpg [1672 B]

Now you can install the essential development packages:

  # apt-get install build-essential debhelper

Now you can use gcc with -static to build a 'hello world' app and then
run the app in the router.