Ubiquiti Bullet M2 / M5

Warning! There are two versions of Ubiquiti Bullet: xm and xw.

The old xm version has limited RAM (32 MB) and thus is not recommended.

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
Bullet M XM (AR7240)Atheros AR7240400832Atheros AR9283-a/n1---
Bullet M XM (AR7241)Atheros AR7241400832Atheros AR9283-a/n1---
Bullet M xwAtheros AR9342¿864Atheros AR9342b/g/na/n1---

OpenWrt 19.07.5 (at least) can be installed on a Bullet M2HP XW device by using the automated process in the true-systems/ubnt-openwrt-flashing repository on GitHub.

  1. Install the stock AirOS firmware XW.v6.1.7.32555.180523.1754.bin. The SHA256 hash should be c6e36003ab82b588936b558dfaf06fd2e54e3bd63b84f17687e023de55f05b23.
  2. Clone the true-systems/ubnt-openwrt-flashing repository. The working commit as of this writing was 7f5509fbb96d49fa150bdbf42527b1c3170ff809.
  3. Update the REMOTE_UBNT variable in the Makefile if necessary.
  4. Download the OpenWrt 19.07.5 factory image. The SHA256 hash should be e2784584dc8a0dc8fca775d98ebac4796f94e85bde8f422b944511bb834be3b5.
  5. Run make flash-factory FW_OWRT=openwrt-19.07.5-ath79-generic-ubnt_bullet-m-xw-squashfs-factory.bin to patch the firmware updater and flash OpenWrt to the device. A backup of the stock firmware will be saved to firmware-backup.bin (and there is a make target for restoring it).

This process is also published at owenh.net/bulletm2hp.

2020-07-29

Downgrade to:

XW.v6.0.6-beta.30875.170526.0023.bin

Then:

XW.v6.0.4.30805.170505.1510.bin

—-

Do not flash a device that has AirOS firmware beyond v.5.5.10 or you will brick your device! You must first revert to version 5.5.10 and then flash OpenWrt https://community.ubnt.com/t5/airOS-SDK-Custom-Development/5-6-2-TFTP-ERROR/m-p/1307614/highlight/true#M2349. If you've already bricked your device, you may try to recover it https://community.ubnt.com/t5/airOS-SDK-Custom-Development/AirMAX-Device-Firmware-Recovery-Procedure/m-p/1499583/highlight/true#M2499.

To flash an already running bullet with original firmware (AirOS) on CLI, you must do this:

ssh root@yourbullet
url="http://downloads.openwrt.org/snapshots/trunk/ar71xx"
url="$url/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin"

wget -O /tmp/fwupdate.bin "$url"
/usr/sbin/fwupdate -m

If you prefer TFTP, than you can update via holding down the reset-button for 10 seconds on startup, and send the firmware to 192.168.1.20
See →generic.flashing or →generic.flashing.tftp for instructions.

http://wiki.ubnt.com/Firmware_Recovery

This section must be wrong since Bullet M2 should use Uboot.

Probably this is for Bullet2 (not M2).

FIXME If the bullet firmware was changed using Fon Flash using files …atheros-root.squashfs and …atheros-vmlinux.lzma the Redboot will have been changed. The result will be that the ubnt recovery method will no longer work.

To fix connect to your router using a serial cable and change the redboot to the below config.

RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. cache off
.. fis load -d -e kernel
.. go

Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 0.0.0.0
Local IP address mask: 0.0.0.0
Default server IP address: 0.0.0.0
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot> 

FIXME

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/01/18 19:45
  • by owenh