Google Wifi No USB

Hello, I am new to this OpenWRT world but would really love to get into it. I have a set of 3 Google Wifi devices which I picked up roughly a year ago. I was looking into flashing them with OpenWRT, however, upon going over the instructions I found that my devices do not use USB-C for power, and instead use the usual round connector. The model for these is GJ2CQ.

Is there any way to get OpenWRT on these or am I out of luck? I looked around inside and I see a power port, 2 ethernet ports and a button. Nothing really in the way of another port to use in developer mode, etc.

Thanks in advance.

https://www.androidpolice.com/2020/09/22/a-new-cheaper-google-wifi-router-is-in-the-works/

The publication found information on a new device codenamed "Breeze" with a "GJ2CQ" model number that fits the scheme of the rest of Google's smart home lineup. This model number can already be found in the Google Wifi app as part of some code responsible for checking whether a device "is Gale" — also known as the original Google Wifi, pictured above. The code essentially verifies whether a router is the new Breeze device or the 2016 Google Wifi.

Looks like the older version with USB C required a special cable to get OpenWrt on there.

Unless these new ones have some sort of serial or debug interface inside them? I'd say you are most likely out of luck.

I have a dead gj2cq in front of me, I'm currently trying to open it to compare it to the teardown of the previous version:
https://www.edn.com/teardown-prying-open-google-wifi/

I'll post my findings when I get in.

1 Like

Getting in was a bit easier than thought, pair of pliers on the bottom lip after removing a single screw google wifi 2020 bottom removed

if you compare to the 2016 the missing red and black wire are from the reset being repositioned on the daughter board behind the barrel jack.

I'm not sure what the blue cable is

other side

There's a 24 ping header labeled "DJ1" which looks a lot like a USB-C header. It may or may not be coded into the firmware, connected to hardware, have all the supporting resistors, ect. Looking at your photos, I'm seeing 5 pins connected. The ground pins are likely connected directly to the ground plane on the board. If I were to GUESS, I'd say those pins are D+, D-, SBU1, SBU2 and one of the VBUS pins. That would fit with Google's normal use of Closed Case Debugging on the SBU buss.

It is also completely possible that that isn't a USB port of any sort, and they may be using the Test Pads (TP) to program the firmware. Someone with experience might be able to follow the traces and figure with TPs are used for that purpose.

It's also possible they pre-program the flash and have no way of uploading after manufacturing.

Trying anything can and likely will destroy your hardware.

If you are a brave (or foolish) soul and want to forge forward, you might connect D+, D-, VBUS and Ground with the proper resistors and see if anyone is home. SBU1 and SBU2 in place of D+ and D- might also reveal a Closed Case Debugging interface with access to the flash or a programming interface. All of these require resistors of specific values between VBUS and certain pins to bring up the USB interface.

Some links that may help:
SuzyQable

USB-C connector pins

Google info on CCD and the SuzyQable

If you try this, please post your results. I'm sure others might be interest in getting away from Google's "Management" Application.

2 Likes

Any progress to get owrt on these type working?

Hi, I built an own SuzyQable by myself. When I plug in the google wifi I can't see any diffrence with "lsusb" before and after USB is plugged in. So I see nothing if I reverse the plug and also nothing if I remove the write-protectetion screw... - Did anyone had success?

Has anyone had any luck installing openwrt to GJ2CQ? Is it even possible?

I've acquired 2 of those GJ2CQ devices by mistake. Good thing at least is that they were sold as defective so I didn't waste a lot of money.
I've tried swapping the daughter board from an AC-1304 with limited success - it boots up but the hub is not recognized so I can't flash another firmware for now (I don't think that the gale vs breeze firmware is different).
I think I've found a suitable USB connectors over here but they'll take a bit of time to arrive.
I'm open to ideas but for now I think there is nothing more I could do.

As mentioned in another Google WiFi thread I found that not all USB-C hubs are equal on this device, you'd better get a more simple one like without SDcard/NIC (the one I use has only 1 x USB-A + 1 x HDMI with power delivery)

Well the original AC-1304 is working fine with both an HP docking station and a simple type C hub but when I plug it in instead of the barrel one nothing is detected there - I can power the GJ2CQ with just the USB cable but it doesn't when I connect it through the hub

I acquired way too many of these GJ2CQ. I'm finding bugs in the IPv6 DNS system that I would like to use SSH to fix. I read that it is using dnsmasq, and if so, I know exactly how to fix it if I can get a terminal. I found the GaleForce project, but ran into the same barrel connector that everyone is talking about here. I wonder if there is some kind of a serial port on the device that could give simple tty access when linked directly to another computer? If so, that may be another way of hacking things on the device. A binary can be downloaded over a network with curl probably. At the very least, that could give access to fix stupid bugs with the thing.

I use them at my house, but I don't entirely rely on just them. It's a long story how I obtained them and integrated them into my home network, but they are just a segment of my home network. I also have way too many of them to use them all anyway. If I can't mod them, I might just get rid of them.

I would like to collaborate a development project if possible. And any leads to further information would be most welcome!

Hey guys, I would hook up, but I need help to get bootloader running again with my device. It is somehow lost everything. The LED's are still turning blue and orange like it is described in the instruction, but no success with factory default.

After research I found out that I need to recover bootloader or "coreboot" first.

My SuzyQable is ready and I also get my device recognized like it is desribed in the openwrt devices page of Serial connection so I see:

[ 2623.179542] usb 1-1.1: config 1 has no interface number 2
[ 2623.180179] usb 1-1.1: New USB device found, idVendor=18d1, idProduct=500f, bcdDevice= 1.00
[ 2623.180182] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 2623.180185] usb 1-1.1: Product: Gale debug
[ 2623.180187] usb 1-1.1: Manufacturer: Google Inc.
[ 2623.240443] usbcore: registered new interface driver usbserial_generic
[ 2623.240456] usbserial: USB Serial support registered for generic
[ 2623.243251] usbcore: registered new interface driver usb_serial_simple
[ 2623.243292] usbserial: USB Serial support registered for carelink
[ 2623.243305] usbserial: USB Serial support registered for zio
[ 2623.243337] usbserial: USB Serial support registered for funsoft
[ 2623.243351] usbserial: USB Serial support registered for flashloader
[ 2623.243400] usbserial: USB Serial support registered for google
[ 2623.243412] usbserial: USB Serial support registered for libtransistor
[ 2623.243422] usbserial: USB Serial support registered for vivopay
[ 2623.243433] usbserial: USB Serial support registered for moto_modem
[ 2623.243445] usbserial: USB Serial support registered for motorola_tetra
[ 2623.243476] usbserial: USB Serial support registered for novatel_gps
[ 2623.243486] usbserial: USB Serial support registered for hp4x
[ 2623.243497] usbserial: USB Serial support registered for suunto
[ 2623.243510] usbserial: USB Serial support registered for siemens_mpi
[ 2623.243545] usb_serial_simple 1-1.1:1.0: google converter detected
[ 2623.243668] usb 1-1.1: google converter now attached to ttyUSB0
[ 2623.243715] usb_serial_simple 1-1.1:1.1: google converter detected
[ 2623.243788] usb 1-1.1: google converter now attached to ttyUSB1

and my log seems like this:

! Settings mismatch !! Type [C-a] [C-v] to see actual port settings
Type [C-a] [C-h] to see available commands
Terminal ready


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 verstage startiTPM: command 0x14 returned 0x0
TPM: command 0x14 returned 0x0
TPM: Set global lock
TPM: tlcl_write(0x0, 0)
TPM: command 0xcd returned 0x0
Slot A is selected
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 0 size 469b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 romstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'cdt.mbn'
CBFS: Found @ offset bac0 size 1ac
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'ddr.mbn'
CBFS: Found @ offset bcc0 size 7d38
DDR version private build initialized
SDI Entry: 0x860038d
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
CBMEM:
IMD: root @ 8727f000 254 entries.
failed.

so it seems that coreboot is damaged

I don't know who might find this useful but Ive spent the last week trying to figure out how to get this working and as of about half an hour ago i got OpenWRT installed. It ended up being a really simple way of getting it to work. Since there is the dedicated power plug we can just add a female UBS A port to the 24 pin header labeled DJ1. Now i went a head and to a multi meter to the VBUS, GND, D+, and D- pins to see if there was anywhere easier to solder to and there is a clust of small copper pads right next to the U59 antenna plug and was able to find pads that where tied to the required pins from the DJ1 header. VBUS is tied to TP1007, GND is tied to TP1006, D+ is tied to TP1005, and D- is tied to TP1004. Once you get the USB port soldered up everything else works the exact same. The only other issue that i had come up along the was was just from trying to skip the initial flashing the OEM firmware before putting in the OpenWRT firmware but after that i got it done with in about an hour. I hope anyone else that is planning on trying this will find this useful.

2 Likes

Would you please explain in details how to install oem via USB? - I hope it's maybe also a possibility for me with suzyQcable.?

Given that the device can now just receive power from the external power brick instead, would it make more sense for us to just solder on the D+/D- USB corresponding wires to the two pads, and avoid the 5v/GND pins entirely? That way, we can just run a usb hub to hold the recovery/firmware usbs.

Not too sure what you mean by the TP100X you refer to though.