Ubiquiti Networks UniFi Travel Router

abgn+ac (AC1200)
UniFi Travel Router
Homepage	Product page
Wikipedia	Ubiquiti Networks
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Ubiquiti Networks UniFi Travel Router
FCC ID	SWX-UTR
Type	travel router
CPU1 Y	Qualcomm IPQ4018
CPU1 Type	ARMv7 Cortex-A7
CPU1 Speed	717 MHz ( 4 cores )
Flash1 Chip	Macronix MX35LFxGE4AB
Flash1 Size	128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (NAND)
Flash2 Chip	Macronix MX25L3205D
Flash2 Size	4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> (NOR)
RAM1 Size	256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br />
RAM1 Chip	Brand? Model?
ETH chip1	Qualcomm IPQ4018
Switch	Qualcomm IPQ4018
Ethernet Port Count	1-1GbE-WAN 4-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	USB 2.0
USB ports	1
USB Hub Compatible	Untested
Power	5 VDC, 2 A
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
Flags: Wi-Fi 6
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Radio 1
Chip1	Qualcomm IPQ4018
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Qualcomm IPQ4018
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 867 Mbps
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.

For a list of all currently documented Ubiquiti Networks devices with specifications, see Ubiquiti Networks.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),

• 867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.) = AC1200 class

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki

Target: ipq40xx
Subtarget: generic
Package architecture: arm_cortex-a7_neon-vfpv4
Supported Since Commit
Support started version: unknown
Current supported version: snapshot

LAN Hardware: Qualcomm Atheros QCA8075
WLAN Hardware: Qualcomm IPQ4018
Installation method(s):
CLI generic
Recovery method(s):
CFE TFTP recovery

git • >>

ipq40xx: add support for Ubiquiti UniFi Travel Router Support for Ubiquiti UniFi Travel Router SoC: IPQ4018 DRAM: 256 MB NAND: Macronix MX35LFxGE4AB 128 MiB NOR: MX25L3205D 4 MiB ETH: 2x 10/100/1000 Ethernet (QCA8075 switch chip) WIFI: 2x IPQ4018 (2.4GHz 802.11n + 5GHz 802.11ac) BT: Internal USB Bluetooth adapter (Cambridge Silicon Radio, 0a12:0001) LCD: ST7789V (135x240), GPIO backlight ACC: ST LIS2DW12 accelerometer (I2C) BTN: Reset UART: through-hole pads on PCB / 3.3V / G, TX, RX, V / 115200n8 USB: 1x USB-C (power), 1x USB-C (host) PWR: 5 VDC, 2 A (USB-C) MAC address layout (mac-base at EEPROM offset 0x0): +0: xx:xx:xx:xx:xx:xx Ethernet WAN +1: xx:xx:xx:xx:xx:xx Ethernet LAN +2: xx:xx:xx:xx:xx:xx 2.4 GHz Wi-Fi +3: xx:xx:xx:xx:xx:xx 5 GHz Wi-Fi The UTR has two slots: kernel0 and kernel1. The built-in TFTP recovery always writes to kernel0, so we want to write to kernel1 to preserve that recovery mechanism. From factory firmware: 1. SSH into your UTR. 2. Check if /proc/cmdline contains ubntbootid=1, then you are on the kernel1 slot: Upgrade/change to a different version of the UTR firmware, this will switch you back to kernel0 slot. Alternatively use the TFTP recovery procedure. Reboot and start over at Step 1. 3. Copy the firmware.ubi to the UTR (scp -O) into /tmp/factory.ubi. 4. Change the boot slot to kernel1. printf '\xff\xff\xff\xff\x2b\xe8\x4d\xa3' > /tmp/bs.bin mtd -e bs write /tmp/bs.bin bs rm -f /tmp/bs.bin 5. Set up uboot config to remove signature checks on kernel1 slot. You need to keep the signature checks to run the stock unifi firmware which we are leaving in kernel0. BOOTCMD_REAL="sf probe; sf read 0x80000000 0x2f0000 0x800; \ mw.b 0x80010000 0xff 0x1; if cmp.b 0x80000000 0x80010000 0x1; \ then echo \"Slot 1 / kernel1\"; run bootopenwrt; \ else echo \"Slot 0 / kernel0\"; bootubnt; fi" fw_setenv -s - <<-EOF bootopenwrt fdt addr \${fdtcontroladdr}; fdt rm /signature; bootubnt bootcmd_real $BOOTCMD_REAL EOF 6. Flash the firmware. MTD="$(grep -w '"kernel1"' /proc/mtd | cut -d: -f1)" ubidetach -p /dev/$MTD 2>/dev/null || true ubiformat /dev/$MTD -y -f /tmp/factory.ubi 7. Reboot reboot ---- To restore the vendor image, switch back to slot 0 and restore signed booting to both slots: printf '\x00\x00\x00\x00\x2b\xe8\x4d\xa3' > /tmp/bs.bin mtd -e bs write /tmp/bs.bin bs rm -f /tmp/bs.bin fw_setenv bootcmd_real 'bootubnt' reboot Then erase slot 1 so it can be used for vendor upgrades: MTD="$(grep -w '"kernel1"' /proc/mtd | cut -d: -f1)" ubidetach -p /dev/$MTD 2>/dev/null || true ubiformat /dev/$MTD Signed-off-by: Matt Eaton Link: https://github.com/openwrt/openwrt/pull/22740 Signed-off-by: Robert Marko