Ubiquiti Bullet M2 / M5

WARNING: On the Bullet M2 xw, OpenWrt 21.02.1 never turns the Ethernet port on. TFTP can be used to revert to OpenWrt 19.07. See https://github.com/openwrt/openwrt/issues/9178 and https://owenh.net/bulletm2hp. The fix (commit e405b96fe774) is now in the main, 22.03, and 23.05 branches and should be included in OpenWrt 22.03.7 and 23.05.3 when those are released.

→ Install OpenWrt (generic explanation)

OpenWrt 19.07.5 (at least) can be installed on a Bullet M2HP XW device by using the automated process in the true-systems/ubnt-openwrt-flashing repository on GitHub.

1. Install the stock AirOS firmware XW.v6.1.7.32555.180523.1754.bin. The SHA256 hash should be c6e36003ab82b588936b558dfaf06fd2e54e3bd63b84f17687e023de55f05b23.
2. Clone the true-systems/ubnt-openwrt-flashing repository. The working commit as of this writing was 7b89450ca1afa9503ae449b6b15daef4cf2ade96.
3. Update the REMOTE_UBNT variable in the Makefile if necessary.
4. Download the OpenWrt 19.07.5 factory image. The SHA256 hash should be e2784584dc8a0dc8fca775d98ebac4796f94e85bde8f422b944511bb834be3b5.
5. Run make flash-factory FW_OWRT=openwrt-19.07.5-ath79-generic-ubnt_bullet-m-xw-squashfs-factory.bin to patch the firmware updater and flash OpenWrt to the device. A backup of the stock firmware will be saved to firmware-backup.bin (and there is a make target for restoring it).

This process is also published at owenh.net/bulletm2hp.

2020-07-29

Downgrade to:

XW.v6.0.6-beta.30875.170526.0023.bin

Then:

XW.v6.0.4.30805.170505.1510.bin

----

Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.

To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:

ssh root@yourbullet
url="http://downloads.openwrt.org/snapshots/trunk/ar71xx"
url="$url/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin"

wget -O /tmp/fwupdate.bin "$url"
/usr/sbin/fwupdate -m

If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to 192.168.1.20
See →generic.flashing or →generic.flashing.tftp for instructions.

http://wiki.ubnt.com/Firmware_Recovery

This section must be wrong since Bullet M2 should use Uboot.

Probably this is for Bullet2 (not M2).

If the bullet firmware was changed using Fon Flash using files ...atheros-root.squashfs and ...atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.

To fix connect to your router using a serial cable and change the redboot to the below config.

RedBoot> fconfig -l

Run script at boot: true
Boot script:
.. cache off
.. fis load -d -e kernel
.. go

Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 0.0.0.0
Local IP address mask: 0.0.0.0
Default server IP address: 0.0.0.0
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot> 

How to add tags