Add U5G Backup modem support via QRTR and uiwwand fallback

[jimstrang]

Summary

The new UniFi U5G Backup modem appears to expose QMI over Qualcomm QRTR rather than the stock USB-style control device paths currently suggested by NetworkOptimizer.

For this device, the stock QMI paths do not exist:

• /dev/cdc-wdm0 -> missing
• /dev/wwan0qmi0 -> missing
• /dev/wwan_ioctl -> exists, but libqmi cannot auto-detect/open it as a usable QMI/MBIM device

The working QMI URI is:

qrtr://3

This lets some QMI calls work, but the classic NAS commands used by NetworkOptimizer for cellular stats are only partially compatible with this modem/firmware.

Device

• Device: UniFi U5G Backup
• Firmware/device is new as of 2026-05-22
• SSH user: ui
• qmicli: 1.38.0
• Kernel observed: 5.15.167-debug-g32b46f30c7fa

Discovery output

qrtr-lookup shows the modem QMI services on node 3:

Service Version Instance Node  Port
      3       1        0    3    50 Network Access Service
      2       1        0    3    61 Device Management Service
     26       1        0    3    58 Wireless data administrative service
      1       1        0    3    56 Wireless Data Service
     47       1        0    3    54 Data Port Mapper

What works

These commands work against qrtr://3:

qmicli -d qrtr://3 --device-open-proxy --dms-get-manufacturer
qmicli -d qrtr://3 --device-open-proxy --dms-get-model
qmicli -d qrtr://3 --device-open-proxy --dms-get-revision
qmicli -d qrtr://3 --device-open-proxy --nas-get-system-info
qmicli -d qrtr://3 --device-open-proxy --nas-get-rf-band-info

Observed examples:

Manufacturer: 'QUALCOMM INCORPORATED'
Model: '334'
Revision: 'MPSS.CY.1.0-01698-KUNO_LE_PACK-1.120463.4.127100.2  1  [Sep 11 2025 09:00:00]'

--nas-get-system-info reports 5G SA service available, MCC 310, MNC 260.

--nas-get-rf-band-info reports:

Radio Interface:   '5gnr'
Active Band Class: 'nr5g-71'
Active Channel:    '125530'
Bandwidth:         '5gnr-20'

What does not work

NetworkOptimizer currently runs this command set in CellularModemService:

qmicli -d <qmiDevice> --device-open-proxy --nas-get-signal-info
qmicli -d <qmiDevice> --device-open-proxy --nas-get-serving-system
qmicli -d <qmiDevice> --device-open-proxy --nas-get-cell-location-info
qmicli -d <qmiDevice> --device-open-proxy --nas-get-rf-band-info

On the U5G Backup with qmiDevice = qrtr://3, the first three fail:

--nas-get-signal-info          -> QMI protocol error (74): 'InformationUnavailable'
--nas-get-serving-system       -> QMI protocol error (71): 'InvalidQmiCommand'
--nas-get-cell-location-info   -> QMI protocol error (13): 'NoNetworkFound'
--nas-get-rf-band-info         -> works

UniFi-native fallback that returns the desired stats

The modem firmware exposes a UniFi WWAN status API over ubus:

ubus call uiwwand call '{"method":"get-radio-status","params":{}}'

That returns the stats NetworkOptimizer wants, for example:

{
  "result": {
    "rat-mode-active": "5G",
    "rsrp": -106,
    "snr": -8.0,
    "rsrq": -19,
    "signal-bars": 2,
    "signal-percent": 45,
    "has-coverage": true,
    "channel": 125530,
    "band-class": "n71",
    "registered-spn": "T-Mobile",
    "roaming": false,
    "mcc": 310,
    "mnc": 260,
    "mode": "5G",
    "5g-sa-mode": true,
    "rsrp-nr": -106,
    "rsrq-nr": -19,
    "snr-nr": -8.0,
    "ca-nr": [
      {
        "primary": true,
        "band": 71,
        "dl-bw-mhz": 20.0,
        "ul-bw-mhz": 20.0,
        "dl-arfcn": 125530,
        "ul-arfcn": 125530
      }
    ]
  }
}

Suggested implementation

For the U5G Backup specifically:

1. Allow/default the QMI device path to qrtr://3 when this model is detected.

2. Add a U5G Backup-specific polling fallback that runs:

   ubus call uiwwand call '{"method":"get-radio-status","params":{}}'

3. Map the JSON fields into CellularModemStats:

   • rsrp-nr or rsrp -> NR RSRP
   • rsrq-nr or rsrq -> NR RSRQ
   • snr-nr or snr -> NR SNR
   • registered-spn -> carrier
   • mcc / mnc -> carrier MCC/MNC
   • roaming -> roaming status
   • band-class, channel, and ca-nr[].dl-bw-mhz -> active band/channel/bandwidth
   • 5g-sa-mode -> standalone 5G indicator
   • signal-percent / signal-bars -> display quality if available

This may be cleaner than trying to force the older NAS signal/location commands on this new firmware, since the UniFi daemon already normalizes the correct 5G SA fields.

[jimstrang]

Additional device metadata:

/etc/version: U5G-Antenna.1.3.4
board.name: U5G-US
board.shortname: U5G-US
board.sysid: 0xe633
OpenWrt: 22.03.5 r20134-5f15225c1e
Target: sdx35/generic
Arch: arm_cortex-a7_neon-vfpv4
Kernel: 5.15.167-debug-g32b46f30c7fa
qmicli: 1.38.0

QMI over QRTR is still on node 3 after reboot/move. The exact QRTR ports shifted slightly after reboot, but the node did not:

3 1 0 3 50 Network Access Service
47 1 0 3 54 Data Port Mapper
1 1 0 3 55 Wireless Data Service
26 1 0 3 57 Wireless data administrative service
2 1 0 3 61 Device Management Service

qrtr://3 remains the correct NetworkOptimizer QMI Device Path for this unit.

[tvancott42]

Thanks for the detailed report here. Looks like ubus call uiwwand call '{"method":"get-radio-status","params":{}}' even works on the U5G-Max so I think I'll work on transitioning all 5G/LTE modems to this method of polling. Should be able to get this done in the next couple patch releases.

[jimstrang]

Sounds good. Holler if you need me to run any additional tests or get command outputs specific to the U5G Backup device.

I also have a U-LTE-Backup-Pro (that is being replaced by the U5G) if you need anything from there as well.

[tvancott42]

@jimstrang I went to work on this today, but I first need to finish reviewing and incorporating a contributor PR for Netgear 5G modem monitoring that abstracts out the modem polling a bit. Should come in the next week for sure.