Bootloop Unifi U6+ | Failed hash integrity | can't load kernel

torwag · March 30, 2026, 4:57pm

I had run openwrt on an U6+ for a while, locked myself out and tried to get back in.
I tried failsafe and reset and as this did not work, I went into tftp mode and reflashed to unifi stock. That worked ok, I can boot and access the unit.
After that I tried to flash back to openwrt, as described in the wiki. I made sure I followed instructions to the point, everything worked seemingly ok.
However, booting I ended up in the TFTP mode.
I connected a serial dongle and the following lines catched my attention:

MMC read: dev # 0, block # 17536, count 8443 ... 8443 blocks read: OK
## Starting application at 0x440000B0 ...
## Application terminated, rc = 0x0
Config #config-a642 not found, using default
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.74
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4298875 Bytes = 4.1 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   0dd92fad
     Hash algo:    sha1
     Hash value:   163c1288115346bbb4f63704b252baa676f8c76c
   Verifying Hash Integrity ... Failed to verify required signature 'key-uap6_mt7981'
 error!
Unable to verify required signature for '' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!

From here on goes on waiting for a TFTP connection
What I tried:

Different version of openwrt images (24,25) always using the squashfs-sysupgrade versions
Different versions of the stock firmware to begin with (using the one mentioned in the openwrt wiki as well as the newest version
I tried "zeroing" the partitions 6,7,8 prior of installing, to make sure no residuals are left
I switched 6 and 7 (kernel on 7, rootfs on 6, just in case it ended up in a strange twist during boot
I wrote on both kernel0 and kernel1 just the kernel to make sure a kernel could be found independent of what uboot tries to boot

So far nothing helped and maybe even more strange, the error remained the same, independent of the flashing differences.

I can enter uboot via the serial console if that helps and there is always the way to get back on stock via TFTP and start from scratch.

I found very similar issues on the forum, but not with a definite solution. I read that the signature will be worked out during installation, maybe something went wrong on that part.
What else puzzles me, is the fact that it states Trying 'kernel-1' kernel subimage where the wiki explicity said to use and boot kernel0, albeit that could just be a doubling in naming stuff.
Unable to verify required signature for '' hash node in 'kernel-1' image node is also concerning as it obviously misses some naming.

Would be glad if someone could give me some hints

bmork · March 30, 2026, 5:11pm

Two possible explanations:

You forgot step 5 (setting bootcmd_real), or
The OEM firmware recovery upgraded u-boot to a version where this hack doesn't work

In the latter case you could try to install an older OEM firmware version, hoping that it downgrades u-boot.

EDIT: wrt this:

It refers to the kernel-1 node in the FIT image. The emmc partition isn't named in the boot log, but you can see that the image is loaded from kernel0 here:

MMC read: dev # 0, block # 17536, count 8443 ... 8443 blocks

If you look at the partition table you'll see that kernel0 starts at 17536.

_bernd · March 30, 2026, 5:11pm

Is this required or shouldn't that be an factory image because of partion layout and stuff

Edit..fixed wording

_bernd · March 30, 2026, 5:13pm

@torwag try to find an older image if possible if this is reproduceable with the mentiend missing step 5.

bmork · March 30, 2026, 5:44pm

The u6+ use two existing emmc partitions for kernel and rootfs. Untarring the sysupgrade image is the correct way to obtain those images when installing from the OEM firmware. As per instructions

torwag · March 30, 2026, 7:48pm

ok downgrading to unifi stock firmware 6.5.54 solved the problem.
Lessons learnt here:
Somewhat newer version seem not to work anymore.

Now that it works the log show:

Verifying Hash Integrity ... crc32+ sha1+ OK

vs.

Verifying Hash Integrity ... Failed to verify required signature 'key-uap6_mt7981'

maybe someone more knowledgeable can explain what has changed, seems that for some reason unif introduced another signature which openwrt doesn't offer?!

Wiki states unifi firmware 6.6.55 is ok, but that didn't work for me either, albeit it could been a mistake on mine side.
Most challenge was to find a suitable download of the stock firmware, as it seems unifi only keeps the last X current versions and rely for older versions on their community forum. Finding a version in a 100+ pages thread suitable for the correct AP was a bit cumbersome.

Maybe if more people here can reproduce this. A note could be added to the Wiki asking for downgrading the unifi firmware if flashing fails.

Thanks to all for the quick input and help.

As a quick help for those who seek for a working unfi firmware (6.5.54), below a link for the following devices:

_bernd · March 30, 2026, 10:07pm

My personal general rule of thumb is to download everything for a product I purchase from a vendor. Just in case. It might come in handy later. Be it a firmware file or just a manual...