Get kernel source code

I use Linux mainline kernel source. My Debian has 6.12.12 kernel.

wget https://mirror.nju.edu.cn/kernel.org/linux/kernel/v6.x/linux-6.12.12.tar.xz

unpack to ~/fromsource/linux-6.12.12/

I think the debian source pkg should also work.

Modify the cp210x driver’s source code

You need to add support for your device in the source code. First get the USB vendor ID and product ID. You can get it from kernel log (journalctl -k |tail) or lsusb command. Kernel log is usually like “idVendor=11ca, idProduct=0211, bcdDevice=1.00”, lsusb output is like “Bus 007 Device 005: ID 11ca:0211 VeriFone Inc Verifone USB to Modem”. In my example, vendor ID is 11ca, product ID is 0211. Now you need to modify the source code at ~/fromsource/linux-6.12.12/drivers/usb/serial/cp210x.c

add
{ USB_DEVICE(0x11CA, 0x0211) },

between all those device vendor ID, product ID lines.

Build the cp210x module

Install some dependencies: pahole and resolve_btfids.

sudo apt install pahole libelf-dev

cd ~/fromsource/linux-6.12.12/
cd ./tools/bpf/resolve_btfids
make
ls -l resolve_btfids
sudo mkdir -p /usr/src/linux-headers-`uname -r`/tools/bpf/resolve_btfids
sudo ln -s $(realpath resolve_btfids) /usr/src/linux-headers-`uname -r`/tools/bpf/resolve_btfids

To avoid Skipping BTF generation for xxx Error:

sudo cp /sys/kernel/btf/vmlinux /usr/lib/modules/`uname -r`/build/

Now it’s time to build the cp210x kernel module.

cd ~/fromsource/linux-6.12.12/drivers/usb/serial/
make -C /lib/modules/`uname -r`/build M=$PWD
ls -l cp210x.ko

Install and load cp210x module

# install cp210x
sudo cp usbserial.ko /lib/modules/`uname -r`/kernel/drivers/usb/serial/usbserial.ko
sudo cp cp210x.ko /lib/modules/`uname -r`/kernel/drivers/usb/serial/cp210x.ko
# you must update module dependency map after cp new file to kernel
# module dir. otherwise, you will get "unknown symbol in module" error.
sudo depmod -a

# load cp210x
sudo modprobe cp210x

Now plugin your device, you should have /dev/ttyUSB0

In kernel log you should see

Nov 29 00:25:26 agem10.dev.emacsos.com kernel: usbcore: registered new interface driver usbserial_generic
Nov 29 00:25:26 agem10.dev.emacsos.com kernel: usbserial: USB Serial support registered for generic
Nov 29 00:25:28 agem10.dev.emacsos.com kernel: usbcore: registered new interface driver cp210x
Nov 29 00:25:28 agem10.dev.emacsos.com kernel: usbserial: USB Serial support registered for cp210x
Nov 29 00:25:28 agem10.dev.emacsos.com kernel: cp210x 7-1.2:1.0: cp210x converter detected
Nov 29 00:25:28 agem10.dev.emacsos.com kernel: usb 7-1.2: cp210x converter now attached to ttyUSB0

Now the device is fully working.

Before You Start

Before you try to access the UART via TTL, check whether telnet is enabled on the current firmware. If telnet is enabled, you don’t need to use UART. Also check if a 3rd party u-boot is installed on the device. If it is, you don’t need to use UART.

Check your USB TTL device is working properly. Plug in your device, you should see /dev/ttyUSB0 shown up in your device tree. In my case, I use a CP2102 USB device, I need to build my own kernel module for it to work.

Get latest OpenWRT files for this device. You can find them at https://firmware-selector.openwrt.org/, type in 360t7, the files will show up. You need the SYSUPGRADE, PRELOADER.BIN, BL31-UBOOT.FIP files.

Connect the UART TTL Cables

It is possible to connect 3 cables to the device without opening the case. Put the device on the table, face down. Put antenna on the left side, put RJ45 sockets on the right side. Put a cellphone flashlight on the back of the device, adjust the flashlight spotlight so you can see 4 holes on the board. The first hole is square; the rest are circles. Ignore the first hole, the remaining 3 circle holes are GND, TX, RX. You need to connect them to your TTL device’s GND, RX, TX.

Get 3 thin metal wire. Those used to fasten charging cables works fine. Remove the outside of the wire. Fold them to Z shape so they can be insert to the 360t7 device through the louver holes on the case. Use tape to fix each wire once they are in position. Connect all 3 wires to duPont wire on your USB TTL device. GND-GND, TX-RX, RX-TX.

Prepare Terminal to Connect to Serial

On Linux, install minicom package. Run minicom with

sudo minicom -D /dev/ttyUSB0

Configure minicom by pressing Ctrl-A O

 Serial port setup
 F - Hardware Flow Control
 G - Software Flow Control

Make sure both says No. Otherwise, keyboard input won’t work.

Save this configure as default in Ctrl-A O menu. Otherwise, each time you start minicom, you need to config this again.

Go To OpenWRT Failsafe Mode

With minicom running, all cables connected, now connect power cable to boot your device. You should see u-boot and kernel output in minicom terminal. After kernel boot, wait for 3s, then press F and Enter key repeatedly to enter failsafe mode.

If you never saw failsafe mode text prompt, let the router boot normally, then flash 360T7-v4.2.4.7959_upgrade.bin in stock firmware web UI. In newer firmware, failsafe mode is disabled, revert to this older version to allow OpenWRT failsafe mode.

Enable Telnet and Set Root Password in Failsafe Mode

Once you get to failsafe mode root shell, run these commands:

fw_setenv bootmenu_delay 3
mount_root
# Enable telnet service
sed -i 's/.*local debug=.*/\tlocal debug=1/' /etc/init.d/telnet
# Set password for root, type a password of your choice twice.
passwd root
cat /proc/mtd
# you should see stock Qihoo 360t7 layout.

root@(none):/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 08000000 00020000 "spi0.0"
mtd1: 00100000 00020000 "bl2"
mtd2: 00080000 00020000 "u-boot-env"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "fip"
mtd5: 02400000 00020000 "ubi"
mtd6: 02400000 00020000 "firmware-1"
mtd7: 02400000 00020000 "plugin"
mtd8: 00100000 00020000 "config"
mtd9: 00080000 00020000 "factory"
mtd10: 00700000 00020000 "log"

Run “reboot” to reboot the device. Now you should use stock u-boot menu. You can use u-boot menu to flash u-boot and firmware, or you can do it in telnet session after the device is fully boot. I choose to use u-boot menu.

On u-boot menu, select “Upgrade ATF BL2”, serve OpenWRT preloader.bin via TFTP. Run mtkautoboot to show u-boot menu again.

Select “Upgrade ATF FIP”, serve OpenWRT bl31-uboot.fip via TFTP. Run “reset” to reboot device. Now you should see OpenWRT’s u-boot menu. It is different than stock u-boot menu.

  ( ( ( OpenWrt ) ) )       U-Boot 2024.10-OpenWrt-r28872-daca7c049b (Sep 19 20

1. Run default boot command.
2. Boot system via TFTP.
3. Boot production system from NAND.
4. Boot recovery system from NAND.
5. Load production system via TFTP then write to NAND.
6. Load recovery system via TFTP then write to NAND.
7. Load BL31+U-Boot FIP via TFTP then write to NAND.
8. Load BL2 preloader via TFTP then write to NAND.
9. Reboot.
a. Reset all settings to factory defaults.
0. Exit

Press UP/DOWN to move, ENTER to select, ESC to quit

Flash OpenWRT

On Linux computer, serve openwrt-mediatek-filogic-qihoo_360t7-initramfs-recovery.itb via 192.168.1.254 TFTP server. In OpenWRT u-boot menu, select “Boot system via TFTP.” It will boot to OpenWRT initramfs-recovery. When initramfs-recovery boots, use ssh or luci to flash OpenWRT sysupgrade image.

After that, router will auto reboot, you will have latest OpenWRT running on Qihoo 360T7.

Could not open mtd device: fip
Can't open device for writing!

You may use this trick to allow write to the FIP and other MTD partitions.

opkg update
opkg install kmod-mtd-rw

insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1
# the i_want_a_brick=1 part is required! Otherwise, the command will fail.

Now you can run the mtd write command again.

If write still fail, make sure the partition name is correct. The partition name is case sensitive. You can check the partition name using

cat /proc/mtd