Ubiquiti Networks Bullet AC

abgn+ac (AC1200)
airMAX Bullet AC
Homepage	Product page
Wikipedia	Ubiquiti Networks
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Ubiquiti Networks Bullet AC
FCC ID	SWX-BDBAC
Type	access point
CPU1 Y	Atheros AR9342
CPU1 Type	MIPS 74Kc
CPU1 Speed	535 MHz
Flash1 Chip	Brand? Model?
Flash1 Size	16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (SPI NOR)
RAM1 Size	64 MiB 67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (DDR2)
RAM1 Chip	Brand? Model?
ETH chip1	Atheros AR9342
Ethernet Port Count	1-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	none specified
PoE	Passive
Power	24 VDC, ? A
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Retail
FCC approval date	20 September 2019
Radio 1
Chip1	Atheros AR9342
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Qualcomm Atheros QCA988x
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 867 Mbps
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented Ubiquiti Networks devices with specifications, see Ubiquiti Networks.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),

• 867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.) = AC1200 class

Overview

Portable, dual-band WiFi radio powered with Gigabit PoE and compatible with the UISP application.

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 21.02.0
Current supported version: 25.12.0

WLAN Hardware: Atheros AR9342, Qualcomm Atheros QCA988x
Installation method(s):
see git-commit
Recovery method(s):
Ubiquiti TFTP

git • >>

ath79: Add support for Ubiquiti Bullet AC CPU: Atheros AR9342 rev 3 SoC RAM: 64 MB DDR2 Flash: 16 MB NOR SPI WLAN 2.4GHz: Atheros AR9342 v3 (ath9k) WLAN 5.0GHz: QCA988X Ports: 1x GbE Flashing procedure is identical to other ubnt devices. https://openwrt.org/toh/ubiquiti/common Flashing through factory firmware 1. Ensure firmware version v8.7.0 is installed. Up/downgrade to this exact version. 2. Patch fwupdate.real binary using `hexdump -Cv /bin/ubntbox | sed 's/14 40 fe 27/00 00 00 00/g' | \ hexdump -R > /tmp/fwupdate.real` 3. Make the patched fwupdate.real binary executable using `chmod +x /tmp/fwupdate.real` 4. Copy the squashfs factory image to /tmp on the device 5. Flash OpenWrt using `/tmp/fwupdate.real -m <squashfs-factory image>` 6. Wait for the device to reboot (copied from Ubiquiti NanoBeam AC and modified) Flashing from serial console 1. Connect serial console (115200 baud) 2. Connect ethernet to a network with a TFTP server, through a passive PoE injector. 3. Press a key to obtain a u-boot prompt 4. Set your TFTP server's ip address, with: setenv serverip <tftp-server-address> 5. Set the Bullet AC's ip address, with: setenv ipaddr <bullet-ac-address> 6. Set the boot file, with: setenv bootfile <name-of-initramfs-binary-on-tftp-server> 7. Fetch the binary with tftp: tftpboot 8. Boot the initramfs binary: bootm 9. From the initramfs, fetch the sysupgrade binary, and flash it with sysupgrade. The Bullet AC is identified as a 2WA board by Ubiquiti. As such, the UBNT_TYPE must match from the "Flashing through factory firmware" install instructions to work. Phy0 is QCA988X which can tune either band (2.4 or 5GHz). Phy1 is AR9342, on which 5GHz is disabled. It isn't currently known whether phy1 is routed to the N connector at all.