User Tools

Site Tools


Ubiquiti Airgrid

Hardware Info

Architecture: MIPS
Vendor: Atheros
Bootloader: U-Boot
System-On-Chip: Atheros MIPS 24Kc
CPU Speed: 390 Mhz
Flash-Chip: MX 25L6405DZNI-126
Flash size: 8 MiB
Wireless: atheros ar9280 and AN950 front-end
Ethernet ports: 1x 10/100 BASE-TX (Cat. 5, RJ-45) Ethernet Interface with PoE
Serial: Yes


The unit is a derivative of the Bullet M5 product. Where the Bullet M5 terminates with a male N connector, the AirGrid M5 feed, that appears to be identical for the 11" x 14" and 17" x 24" grid versions, contains an elongated and narrow PCB with on one end the LAN RJ45 connector and reset swich and on the other an array of goldplated pins that radiate and receive the radio signals. The entire unit has been shaped so that these pins will be positioned in the focal point of the parabolic antenna reflector that is part of the AirGrid product. The CPU, that gets fairly warm, carries a small heatsink. The encasing consists of three pieces when combined with a 11 x 14" reflector grid plus an extension piece when combined with a 17 x 24" reflector grid: 1) a mounting piece that connects to the antenna reflector, 2) an encasing of the PCB that fits and clicks into the mounting piece, 3) a lid closing that encasing an glued into it. 4) extension cylinder in case of 17 x 24" grid

Feed principle

The pick up of the electromagnetic energy in the focal point of the grid is accomplished using a double Yagi principle. Two tree element Yagi antennas have the pick-up dipole element in common and share a sheet metal reflector that has been clicked on the inside into the closing lid of the feed. The director pins each face the centre of one half of the elongated reflector. This type of feed collects most energy in the transverse plane (perpendicular to the pick-up dipole) and less in the sagittal plane (parallel to the plane of polarization). This explains the elongated shape of the parabolic grid that has been adapted to the radiation pattern of the two Yagi pick-ups. When the plane of polarization is to be horizontal while the cable still leaves the encasing towards the ground the feed needs to be clicked into the mounting cylinder 90° rotated and the reflector grid must be 90° rotated as it has to remain its long axis aligned to the radiation pattern of the dual Yagi feed. The other polarization direction is not received or emitted, e.g. through a cross-yagi version of this feed, although the ar9280 is 2x2 MIMO capable.


Managed to open the encasing undamaged by exerting deforming pressure on the lid using a vice. The edges then need cleaning and application of glue for the feed to be shut again and be water proof. For serious servicing probably some pulling tool should be used that would grip into the tiny slit between the two parts. Local application of force by a knive blade to peel the parts apart is likely to damage the plastic.


Although the construction does not seem to envisage being opened a 4-pin serial header has been mounted on the PCB. Pin 1 (gnd) is the pin closest to the radio section. As pin 4 carries 3.3V proper orientation of the serial connector is important. Bitrate: 115200 8N1


There seem to exist two PoE versions, one based on 5V per USB and one based on 24V. A recently purchased model (manuf. April 2010) came with a 24V PoE adapter. The regulator IC on the PCB is an AOZI1212AI. Its specifications say: input 4.5V to 27V. This means that the 24V PoE supply that comes with the unit actually makes the switched mode circuit operate quite close to its limits. A 15 or 18V PoE supply unit would be more appropriate.


Ubiquiti's firmware applies the Madwifi driver. An OpenWrt trunk image (Sept. 2010) with ath9k as driver has been tested with good result. In config/wireless used hwmode 11na and htmode HT40-. As there is only one spatial stream only 1x1 MIMO is possible which limits the MCS modes to 135 Mbps. This value was indeed observed in communication between two Airgrid M5 units, one with OpenWrt with ath9k and the other with the original AirOS firmware which applies the Madwifi radio driver.


OpenWrt detects the 4 LEDs that can be user controlled. They can be controlled here:





In shell cat trigger will show the many options to control these LEDS. When operated in timer mode two more entries, delay_on and delay_off will be available that can be programmed.


The unit can be brought in a mode where it starts a tftp server and waits for firmware. Press the reset switch with some pin through the small opening and apply power. Hold the reset a while and then release it. There will be two flashing lights alternating position. Observed different behaviour in different units. One, with original firmware, was listening as expected on for tftp transfer and was pingable, Another was listening on and was not pingable. I had been playing with the gpio settings from within OpenWrt on that one so may have doen something wrong which caused U-BOOT to change some environment settings. Its default IP address had also changed from to Using the serial console these settings can be changed from within U-BOOT (setenv , saveenv). The U-BOOT environment settings are stored in /dev/mtd1.

XM and XW original firmware issues

Flashing an OpenWrt image into 2016/2017 production versions of the Airgrid M (HP)range, using tftp, may cause problems and an error message. The recent 5.6.x original firmware provides for uboot settings that do not allow for the partitioning of flash to be changed by OpenWrt. The following worked for me on an Airgrid M5 HP with XW type hardware:

  • Find an old original firmware and flash it via the web AirOS web interface. I used XW.v5.5.9.21734.140403.1801.bin (obviously not to be found on the manufacturer's site but available on the internet)
  • There will be a warning about possibly loosing features; ignore it and flash.
  • After this bring the device in tftp recovery mode using the little micro switch opening.
  • Now tftp will work using openwrt-ar71xx-generic-ubnt-nano-m-xw-squashfs-factory.bin

Alternatively one could connect to the board via a serial link and make uboot set the default mtd settings. This is quite difficult though because this product is sealed in a way that is not meant to be ever opened again. Managed once to open one without real damage by putting force in a vice on the front cap, but it is everything but elegant. To close it 2-component sealing will be needed. So better try the software way first!

toh/ubiquiti/airgrid.txt · Last modified: 2017/01/16 22:17 by tmomas