I did not manage to boot the snapshot, the first reboot took me to what you see now
Ok, then probably something went wrong with writing the file to the eMMC. Because obviously the bl2
image in /dev/mmcblk0boot0
has never been touched, it’s still the one which belongs (and only works with) the stock firmware.
It seems that neither NAND nor eMMC can boot to uboot, so it can only be returned to the factory for repair.
Because BPI-R3 MINI can’t support boot from SD, So the factory will flash one default image into Nand and EMMC Device.
Anytime please confirm that one EMMC or Nand device include one bootable image, it’s very important!!
Anytime please confirm that one EMMC or Nand device include one bootable image, it’s very important!!
I had booted to NAND successfully in order to flash EMMC, and left it untouched for exactly that reason, however it seems that once I wrote to EMMC something the NAND boot required was damaged and would no longer boot, which is not something that I had expected would happen.
Is there anyway to perform the factory flash process at home? Otherwise, what is the process to send it back for repair?
It should be booted from nand and then write emmc. Maybe you wrote the wrong device.
If you are not familiar with how to write these devices, you can use BPI-R3 to practice first. R3 can be booted from the SD card.
Professional equipment is required to remove the NAND and use a programmer to program it.
If you can’t do it yourself, you can contact our sales
The devices written to and commands run were stated in the first post as well
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-preloader.bin of=/dev/mmcblk0boot0
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip of=/dev/mmcblk0p3
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-initramfs-recovery.itb of=/dev/mmcblk0p4
dd if=/tmp/openwrt-*-bananapi_bpi-r3-mini-squashfs-sysupgrade.itb of=/dev/mmcblk0p5
sync
All of these explicitly state mmcblk0 as the target device (eMMC)
… except for the top one which has to go to /dev/mmcblk0boot0
and apparently has not been written there (as the log shows that the old content of /dev/mmcblk0boot0
still seems to be in place).
You can recover the device using
All you need is the serial console connected and a custom build of TF-A BL2. Let me know if you need any help doing so.
maybe openwrt uses different offset for fip? or as far as i remember…daniel changed to fip in ubifs (not sure if for r3mini too), so flashing to existing partitions may not work.
have you tried it before? looks interesting
what needs to be changed for bl2? is the img (with brom header) right here (looks like they use a bin file which should be bl2.bin)?
imho you need fip too to allow reflashing anything. i guess you need to set loadaddress to the fip-offset in bl2…am i right? readme says fip needs the download-mode support…many question marks for the binaries and options in my case
Needs more time than I have available right now, but I do at least see hope. I tried a few different combinations of stock/new/modified bl2/bl31.fip etc, baud, arch, with/wo fip, and all seemed to send fine, but none seemed to survive long enough to send anything back over tty after they JMP’d. I’m going to guess that Frank is right, and I need to be sending some subset of the actual bl2 file; I made some educated guesses based on the hexdump and the abundance of 0x00 and 0xff at the start, but I doubt I was right.
one example:
$ ./mtk_uartboot --aarch64 --brom-load-baudrate 115200 --bl2-load-baudrate 115200 --payload ../openwrt-mediatek-filogic-bananapi_bpi-r3-mini-snand-preloader.bin --fip ../openwrt-mediatek-filogic-bananapi_bpi-r3-mini-snand-bl31-uboot.fip
mtk_uartboot - 0.1.0
Using serial port: /dev/ttyUSB0
Handshake...
hw code: 0x7986
hw sub code: 0x8a00
hw ver: 0xca01
sw ver: 0x1
Baud rate set to 115200
sending payload to 0x201000...
Checksum: 0x154d
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
==================================
Timeout waiting for specified message.
Yes, I’ve been involved with this since January, just couldn’t talk about it because we did responsible disclosure procedure with MTK…
You really really really really have to build a custom bl2. NONE of the existing release binaries will work. The tool is working fine, but the bl2 image needs to be a special one specifically compiled for loading FIP via UART, otherwise it won’t work.
Can bpi or mtk release such binaries (if code is closed) for recovering r3mini?
Or do we only need some specific options set in atf and uboot?
this looks related:
plat/mediatek/mt7986/platform.mk:57:$(call MAKE_DEP,bl2,bl2_boot_ram,RAM_BOOT_DEBUGGER_HOOK RAM_BOOT_UART_DL)
seems it can be enabled via
plat/mediatek/apsoc_common/bl2/bl2_image.mk:32:ifeq ($(RAM_BOOT_UART_DL), 1)
It’s very easy to build the “special” bl2 from source:
git clone https://github.com/mtk-openwrt/arm-trusted-firmware.git
cd arm-trusted-firmware
make CROSS_COMPILE=aarch64-none-elf- PLAT=mt7986 DRAM_USE_DDR4=1 RAM_BOOT_UART_DL=1 BOOT_DEVICE=ram
Edit: LOL, there is even make menuconfig
now in TF-A, that makes it extra easy.
thx so i was on the right track will try it too when i’m back home
Yep, that worked pretty much out of the box, I’m now sitting in uboot, but I’m not sure yet where to take it from here
Edit: for completeness:
apt install device-tree-compiler # (Plus probably a ton of other stuff I already had)
git clone https://github.com/mtk-openwrt/arm-trusted-firmware.git bl2
mkdir -p bl2/gcc
cd bl2/gcc
curl -L 'https://developer.arm.com/-/media/Files/downloads/gnu/13.2.rel1/binrel/arm-gnu-toolchain-13.2.rel1-x86_64-aarch64-none-elf.tar.xz' | tar -xJv
cd ..
make PATH="$PWD/gcc/arm-gnu-toolchain-13.2.Rel1-x86_64-aarch64-none-elf/bin:$PATH" CROSS_COMPILE=aarch64-none-elf- PLAT=mt7986 DRAM_USE_DDR4=1 RAM_BOOT_UART_DL=1 BOOT_DEVICE=ram
mtk_uartboot --aarch64 --payload /build/bl2/build/mt7986/release/bl2.bin --fip ../openwrt-mediatek-filogic-bananapi_bpi-r3-mini-emmc-bl31-uboot.fip
Great, so now you have many options, but it’s still a bit tricky, because the Airoha PHY firmware supposedly also cannot yet be loaded from anywhere, so you won’t have Ethernet in U-Boot. As you were loading the for-eMMC-build of U-Boot, it tries to find the Airoha PHY firmware in /dev/mmcblk0boot1
. First thing is to store it there, so Ethernet works and then you can continue to load all the rest much faster via Ethernet.
This is how:
- Create concatenated firmware binary on your nearly Linux host:
cat /lib/firmware/airoha/EthMD32.dm.bin /lib/firmware/airoha/EthMD32.DSP.bin > /tmp/en8811h-firmware
(if the files don’t exist in your Linux installation you may download them from the linux-firmware repository)
- Use
loady
command in U-Boot to load this binary via YModem protocol (uselrzsz
package on your host).
loady $loadaddr
- Write the binary data to the
boot1
hardware partition of the eMMC
mmc partconf 0 1 2 2
mmc erase 0x0 0x120
mmc write $loadaddr 0x0 0x120
mmc partconf 0 1 1 0
-
Call
bootmenu
and use the menu to write BL2, FIP and firmware to eMMC The first Ethernet port (near USB-C power connector) needs to be connected to your computer providing a TFTP server on static address 192.168.1.254/24. It should serve the r3-mini related files from Index of /snapshots/targets/mediatek/filogic/ orbin/targets/mediatek/filogic
of your local build. -
If you want to run OpenWrt also from SPI-NAND:
tftpboot openwrt-mediatek-filogic-bananapi_bpi-r3-mini-snand-factory.bin
mtd erase spi-nand0
mtd write spi-nand0 $loadaddr $filesize
Progress? I at least make it to linux/initramfs now, but now we got new and exciting issues
[ 2.708388] mtk-msdc 11230000.mmc: Final PAD_DS_TUNE: 0x14014
[ 2.715317] mmc0: new HS400 MMC card at address 0001
[ 2.721174] mmcblk0: mmc0:0001 008GB0 7.28 GiB
[ 2.727443] mmcblk0boot0: mmc0:0001 008GB0 4.00 MiB
[ 2.733287] mmcblk0boot1: mmc0:0001 008GB0 4.00 MiB
[ 2.738487] mmcblk0rpmb: mmc0:0001 008GB0 4.00 MiB, chardev (249:0)
[ 2.999219] mtk-pcie-gen3 11280000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x1)
[ 3.008014] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[ 3.017897] FIT: Detected U-Boot 2024.01-OpenWrt-r25361-a86ff06d2e
[ 3.024077] FIT: Selected configuration: "config-mt7986a-bananapi-bpi-r3-mini" (OpenWrt bananapi_bpi-r3-mini)
[ 3.033978] FIT: kernel sub-image 0x00001000..0x0056c283 "kernel-1" (ARM64 OpenWrt Linux-6.1.79)
[ 3.043707] FIT: flat_dt sub-image 0x0056d000..0x005743b1 "fdt-1" (ARM64 OpenWrt bananapi_bpi-r3-mini device tree blob)
[ 3.055344] FIT: filesystem sub-image 0x00575000..0x00a88fff "rootfs-1" (ARM64 OpenWrt bananapi_bpi-r3-mini rootfs)
[ 3.066706] block ubiblock0_4: mapped 1 uImage.FIT filesystem sub-image as /dev/fit0
[ 3.076904] UBI: auto-attach mtd1
[ 3.080218] ubi: mtd1 is already attached to ubi0
[ 3.084908] UBI error: cannot attach mtd1
[ 3.121835] VFS: Mounted root (squashfs filesystem) readonly on device 259:0.
# ...
[ 3.731521] init: - preinit -
[ 4.449243] mtk_soc_eth 15100000.ethernet eth0: validation of 2500base-x with support 00000000,00000000,000062e8 and advertisement 00000000,00000000,000062c0 failed: -EINVAL
[ 4.464795] leds mdio-bus:0e:green:lan: Setting an LED's brightness failed (-524)
[ 4.472356] leds mdio-bus:0e:yellow:lan: Setting an LED's brightness failed (-524)
[ 4.519200] mtk_soc_eth 15100000.ethernet eth0: mtk_open: could not attach PHY: -22
ip: SIOCSIFFLAGS: Invalid argument
#But it boots! ...mostly
root@(none):/# ifconfig eth0 192.168.1.5
[ 108.389252] mtk_soc_eth 15100000.ethernet eth0: validation of 2500base-x with support 00000000,00000000,000062e8 and advertisement 00000000,00000000,000062c0 failed: -EINVAL
[ 108.404801] leds mdio-bus:0e:green:lan: Setting an LED's brightness failed (-524)
[ 108.412352] leds mdio-bus:0e:yellow:lan: Setting an LED's brightness failed (-524)
[ 108.419960] leds cgroup.procs: Setting an LED's brightness failed (-524)
[ 108.426649] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000008
[ 108.437324] Mem abort info:
[ 108.440106] ESR = 0x0000000096000005
[ 108.443837] EC = 0x25: DABT (current EL), IL = 32 bits
[ 108.449129] SET = 0, FnV = 0
[ 108.452172] EA = 0, S1PTW = 0
[ 108.455297] FSC = 0x05: level 1 translation fault
[ 108.460158] Data abort info:
[ 108.463022] ISV = 0, ISS = 0x00000005
[ 108.466840] CM = 0, WnR = 0
[ 108.469795] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000040fc8000
[ 108.476216] [0000000000000008] pgd=0800000042956003, p4d=0800000042956003, pud=0800000042956003, pmd=0000000000000000
[ 108.486807] Internal error: Oops: 0000000096000005 [#1] SMP
[ 108.492360] Modules linked in:
[ 108.495400] CPU: 2 PID: 1831 Comm: ifconfig Not tainted 6.1.77 #0
[ 108.501474] Hardware name: Bananapi BPi-R3 Mini (DT)
[ 108.506419] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 108.513360] pc : kernfs_find_and_get_ns+0x1c/0x70
[ 108.518053] lr : sysfs_unmerge_group+0x20/0x64
[ 108.522481] sp : ffffffc00b7ab870
[ 108.525778] x29: ffffffc00b7ab870 x28: ffffff8001035940 x27: 0000000000000000
[ 108.532894] x26: 0501a8c000001043 x25: ffffff800119b800 x24: 0000000000000000
[ 108.540009] x23: 0000000000000080 x22: 0000000000000000 x21: ffffffc0088e5978
[ 108.547125] x20: ffffffc0088e5858 x19: 0000000000000000 x18: 00000000000000d1
[ 108.554240] x17: 2064656c69616620 x16: 7373656e74686769 x15: ffffffc008b89aa0
[ 108.561355] x14: 0129e875afe29226 x13: ffffffc008887720 x12: 00000000dbfbb796
[ 108.568470] x11: 00000000000002d6 x10: 00000000000008c0 x9 : ffffffc00b7ab760
[ 108.575586] x8 : ffffff8000c6f2e0 x7 : 0000000000000002 x6 : 0000000000000001
[ 108.582701] x5 : 000000193c715800 x4 : 0000000000000000 x3 : ffffff8000c6e9c0
[ 108.589815] x2 : 0000000000000000 x1 : ffffffc0088e5978 x0 : 0000000000000000
[ 108.596931] Call trace:
[ 108.599362] kernfs_find_and_get_ns+0x1c/0x70
[ 108.603704] sysfs_unmerge_group+0x20/0x64
[ 108.607783] dpm_sysfs_remove+0x2c/0x70
[ 108.611605] device_del+0xa4/0x440
[ 108.614994] device_unregister+0x14/0x30
[ 108.618900] led_classdev_unregister+0x84/0xf0
[ 108.623330] phy_remove+0x38/0x90
[ 108.626633] device_remove+0x68/0x7c
[ 108.630195] device_release_driver_internal+0x1d4/0x240
[ 108.635403] device_release_driver+0x14/0x20
[ 108.639657] phy_detach+0xc4/0x15c
[ 108.643044] phylink_fwnode_phy_connect+0xe4/0x100
[ 108.647817] phylink_of_phy_connect+0x18/0x20
[ 108.652156] mtk_open+0x34/0xa20
[ 108.655372] __dev_open+0x10c/0x1a4
[ 108.658850] __dev_change_flags+0x138/0x190
[ 108.663017] dev_change_flags+0x20/0x60
[ 108.666838] devinet_ioctl+0x38c/0x680
[ 108.670572] inet_ioctl+0x228/0x240
[ 108.674046] sock_ioctl+0x2c8/0x430
[ 108.677524] __arm64_sys_ioctl+0x4b8/0xedc
[ 108.681607] invoke_syscall.constprop.0+0x4c/0xe0
[ 108.686294] do_el0_svc+0x40/0xd0
[ 108.689593] el0_svc+0x14/0x4c
[ 108.692635] el0t_64_sync_handler+0xec/0x120
[ 108.696889] el0t_64_sync+0x14c/0x150
[ 108.700538] Code: aa0003f3 a9025bf5 aa0103f5 aa0203f6 (f9400400)
[ 108.706611] ---[ end trace 0000000000000000 ]---
[ 108.713773] Kernel panic - not syncing: Oops: Fatal exception
[ 108.719500] SMP: stopping secondary CPUs
[ 108.723408] Kernel Offset: disabled
[ 108.726879] CPU features: 0x00000,00000004,0000400b
[ 108.731739] Memory Limit: none
[ 108.737243] Rebooting in 3 seconds..
Cut down as much as I could, lmk if you want me to upload the full dmesg somewhere
You are missing kmod-phy-airoha-en8811h
. And yes, kernel LED core shouldn’t crash when trying to configure a LED on a PHY which doesn’t have a driver yet, anyway, but that’s another problem…
…May have found the issue
brw------- 1 root root 179, 0 Jan 1 1970 mmcblk0
brw------- 1 root root 179, 8 Jan 1 1970 mmcblk0boot0
brw------- 1 root root 179, 16 Jan 1 1970 mmcblk0boot1
crw------- 1 root root 249, 0 Jan 1 1970 mmcblk0rpmb
mmcblk0 is supposed to have. partitions. on it right
Alright, I think I’ve got the partitions set back up on emmc by writing the gpt to 0x0, but it’s still not loading the firmware.
root@(none):/dev# dd if=mmcblk0boot1 bs=144k count=1 | md5sum
7b143b746e9b786396249bec507fd566 -
[ 3.564207] mtk-pcie-gen3 11280000.pcie: host bridge /soc/pcie@11280000 ranges:
[ 3.571560] mtk-pcie-gen3 11280000.pcie: Parsing ranges property...
[ 3.577812] mtk-pcie-gen3 11280000.pcie: MEM 0x0020000000..0x002fffffff -> 0x0020000000
[ 3.628346] mtk-msdc 11230000.mmc: Final PAD_DS_TUNE: 0x14014
[ 3.635275] mmc0: new HS400 MMC card at address 0001
[ 3.641108] mmcblk0: mmc0:0001 008GB0 7.28 GiB
[ 3.647437] Alternate GPT is invalid, using primary GPT.
[ 3.653484] mmcblk0: p1 p2 p3 p4 p5 p128
[ 3.658608] mmcblk0boot0: mmc0:0001 008GB0 4.00 MiB
[ 3.664399] mmcblk0boot1: mmc0:0001 008GB0 4.00 MiB
[ 3.669589] mmcblk0rpmb: mmc0:0001 008GB0 4.00 MiB, chardev (249:0)
[ 3.919193] mtk-pcie-gen3 11280000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x1)
[ 3.927984] mtk-pcie-gen3: probe of 11280000.pcie failed with error -110
[ 3.935820] FIT: Detected U-Boot 2024.01-OpenWrt-r25361-a86ff06d2e
[ 4.572609] init: - preinit -
[ 4.819221] mtk_soc_eth 15100000.ethernet eth0: validation of 2500base-x with support 00000000,00000000,000062e8 and advertisement 00000000,00000000,000062c0 failed: -EINVAL
[ 4.834769] leds mdio-bus:0e:green:lan: Setting an LED's brightness failed (-524)
[ 4.842396] leds mdio-bus:0e:yellow:lan: Setting an LED's brightness failed (-524)
[ 4.889176] mtk_soc_eth 15100000.ethernet eth0: mtk_open: could not attach PHY: -22
ip: SIOCSIFFLAGS: Invalid argument
[ 13.509216] mtk_soc_eth 15100000.ethernet eth0: validation of 2500base-x with support 00000000,00000000,000062e8 and advertisement 00000000,00000000,000062c0 failed: -EINVAL
[ 13.524770] leds mdio-bus:0e:green:lan: Setting an LED's brightness failed (-524)
[ 13.532345] leds mdio-bus:0e:yellow:lan: Setting an LED's brightness failed (-524)
[ 13.539971] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000068
[ 13.550648] Mem abort info:
[ 13.553427] ESR = 0x0000000096000005
[ 13.557159] EC = 0x25: DABT (current EL), IL = 32 bits
[ 13.562459] SET = 0, FnV = 0
[ 13.565498] EA = 0, S1PTW = 0
[ 13.568623] FSC = 0x05: level 1 translation fault
[ 13.573486] Data abort info:
[ 13.576351] ISV = 0, ISS = 0x00000005
[ 13.580174] CM = 0, WnR = 0
[ 13.583126] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000043e2b000
[ 13.589550] [0000000000000068] pgd=08000000453f4003, p4d=08000000453f4003, pud=08000000453f4003, pmd=0000000000000000
[ 13.600143] Internal error: Oops: 0000000096000005 [#1] SMP
[ 13.605696] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7915e mt76_connac_lib mt76 mac80211 cfg80211 slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c compat crypto_safexcel pwm_fan sha1_generic seqiv md5 des_generic libdes authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd gpio_button_hotplug usbcore usb_common
[ 13.665949] CPU: 3 PID: 1558 Comm: netifd Not tainted 6.1.77 #0
[ 13.671850] Hardware name: Bananapi BPi-R3 Mini (DT)
[ 13.676796] pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 13.683737] pc : led_classdev_unregister+0x10/0xf0
[ 13.688517] lr : phy_remove+0x38/0x90
[ 13.692167] sp : ffffffc00b30b9f0
[ 13.695464] x29: ffffffc00b30b9f0 x28: ffffff8000929940 x27: 0000000000000000
[ 13.702580] x26: 0000007fea8da278 x25: 0000000000001003 x24: ffffffc0088fb1e0
[ 13.709696] x23: 0000000000000080 x22: ffffff8000924880 x21: ffffff8000924c18
[ 13.716811] x20: ffffff8000924800 x19: 0000000000000018 x18: 0000000000000002
[ 13.723927] x17: 2064656c69616620 x16: 7373656e74686769 x15: 75622d6f69646d2f
[ 13.731042] x14: 0000000000000004 x13: ffffff8000025910 x12: 0000000000000000
[ 13.738157] x11: ffffff800045be10 x10: ffffff800045bd98 x9 : ffffff8000025910
[ 13.745273] x8 : ffffff800045bdc0 x7 : 0000000000000000 x6 : 0000000000000008
[ 13.752387] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000001
[ 13.759503] x2 : ffffffffffffffff x1 : ffffff80018ca550 x0 : 0000000000000018
[ 13.766619] Call trace:
[ 13.769051] led_classdev_unregister+0x10/0xf0
[ 13.773477] phy_remove+0x38/0x90
[ 13.776779] device_remove+0x68/0x7c
[ 13.780342] device_release_driver_internal+0x1d4/0x240
[ 13.785549] device_release_driver+0x14/0x20
[ 13.789804] phy_detach+0xc4/0x15c
[ 13.793191] phylink_fwnode_phy_connect+0xe4/0x100
[ 13.797964] phylink_of_phy_connect+0x18/0x20
[ 13.802303] mtk_open+0x34/0xa20
[ 13.805519] __dev_open+0x10c/0x1a4
[ 13.808996] __dev_change_flags+0x138/0x190
[ 13.813164] dev_change_flags+0x20/0x60
[ 13.816984] dev_ifsioc+0x434/0x454
[ 13.820461] dev_ioctl+0x144/0x4d0
[ 13.823849] sock_ioctl+0x1ac/0x430
[ 13.827326] __arm64_sys_ioctl+0x4b8/0xedc
[ 13.831410] invoke_syscall.constprop.0+0x4c/0xe0
[ 13.836098] do_el0_svc+0x40/0xd0
[ 13.839397] el0_svc+0x14/0x4c
[ 13.842439] el0t_64_sync_handler+0xec/0x120
[ 13.846693] el0t_64_sync+0x14c/0x150
[ 13.850344] Code: a9be7bfd 910003fd a90153f3 aa0003f3 (f9402800)
[ 13.856416] ---[ end trace 0000000000000000 ]---
[ 13.863897] Kernel panic - not syncing: Oops: Fatal exception
[ 13.869624] SMP: stopping secondary CPUs
[ 13.873532] Kernel Offset: disabled
[ 13.877002] CPU features: 0x00000,00000004,0000400b
[ 13.881863] Memory Limit: none
[ 13.887688] Rebooting in 3 seconds..
Edit: I’m also noticing that there’s no /lib/firmware/airoha
in whatever rootfs this is sourcing