Merge pull request #1489 from kernelkit/disable-release-tests

Temporarily disable release regression tests
.github: temporarily disable release regression tests
2026-07-22 01:13:00 +02:00 · 2026-05-04 10:05:45 +02:00 · 2026-05-04 09:33:46 +02:00 · 2026-04-30 18:53:48 +02:00 · 2026-04-30 18:34:35 +02:00 · 2026-04-30 16:08:51 +02:00
805 changed files with 41866 additions and 7892 deletions
@@ -1,8 +1,10 @@
 Limited free support is only available using the online resources of the
-project on GitHub, and Discord, see <https://github.com/kernelkit>:
+project on GitHub, and Discord, see <https://github.com/kernelkit/infix>:

+&nbsp;&nbsp; :house: <https://www.kernelkit.org> — home page, blog, news, howto's and tutorials  
+&nbsp;&nbsp; :package: <https://github.com/kernelkit/infix/releases/latest> — latest release  
 &nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
-&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>  

 Support contracts, development of new features, fast-tracking of reviews
 and contributions, customer branding of Infix, and even customer specific
@@ -16,7 +16,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Validate release version format
      id: validate
@@ -170,7 +170,7 @@ jobs:
        fi

    - name: Upload signed artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: signed-infix-${{ steps.validate.outputs.file_version }}
        path: ${{ steps.download_signed.outputs.signed_filename }}
@@ -212,4 +212,4 @@ jobs:
        ---

        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
-        EOF
+        EOF
@@ -19,10 +19,17 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
+          - bpi_r4_sd_boot
+          - bpi_r4_emmc_boot
+          - bpi_r64_sd_boot
+          - bpi_r64_emmc_boot
          - cn9130_crb_boot
          - fireant_boot
          - nanopi_r2s_boot
+          - rpi2_boot
          - rpi64_boot
+          - sama7g54_ek_emmc_boot
+          - sama7g54_ek_sd_boot
    env:
      MAKEFLAGS: -j5
    steps:
@@ -34,7 +41,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
          clean: true
@@ -63,24 +70,11 @@ jobs:

          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."

-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
+      - uses: kernelkit/actions/cache-restore@v1
        with:
-          path: dl/
-          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-boot-
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-boot-${{ matrix.defconfig }}-
-            ccache-boot-
-            ccache-
+          target: ${{ matrix.defconfig }}
+          dl-prefix: dl-boot
+          ccache-prefix: ccache-boot

      - name: Configure ${{ matrix.defconfig }}_defconfig
        run: |
@@ -102,7 +96,7 @@ jobs:
          mv images ${{ steps.vars.outputs.dirname }}
          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.archive }}
          name: artifact-${{ matrix.defconfig }}
@@ -114,7 +108,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -8,9 +8,13 @@ on:
        type: choice
        required: true
        options:
+          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
+          - bananapi-bpi-r4
+          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
+          - microchip-sama7g54-ek
        default: 'raspberrypi-rpi64'

 jobs:
@@ -19,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          clean: true
          fetch-depth: 0
@@ -49,6 +53,11 @@ jobs:
      - name: Set bootloader and target based on board
        run: |
          case "${{ inputs.board }}" in
+            raspberrypi-rpi2)
+              echo "BOOTLOADER=rpi2-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
+              ;;
            raspberrypi-rpi64)
              echo "BOOTLOADER=rpi64-boot" >> $GITHUB_ENV
              echo "ARCH=aarch64" >> $GITHUB_ENV
@@ -60,11 +69,29 @@ jobs:
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
+            bananapi-bpi-r4)
+              echo "BOOTLOADER_SD=bpi-r4-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r4-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
+            bananapi-bpi-r64)
+              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
            friendlyarm-nanopi-r2s)
              echo "BOOTLOADER=nanopi-r2s-boot" >> $GITHUB_ENV
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=false" >> $GITHUB_ENV
              ;;
+            microchip-sama7g54-ek)
+              echo "BOOTLOADER_SD=sama7g54-ek-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=sama7g54-ek-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=arm" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
            *)
              echo "Error: Unknown board ${{ inputs.board }}"
              exit 1
@@ -250,7 +277,7 @@ jobs:
          fi

      - name: Upload images as artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: images-${{ inputs.board }}
          path: |
@@ -20,24 +20,16 @@ jobs:
    runs-on: [self-hosted, release]
    strategy:
      matrix:
-        target: [aarch64, x86_64]
+        target: [aarch64, arm, x86_64]
      fail-fast: false
    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          clean: true
          submodules: recursive

+      - uses: kernelkit/actions/podman-cleanup@v1
+
      - name: Set Release Variables
        id: vars
        run: |
@@ -48,24 +40,10 @@ jobs:
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT

-      - name: Restore Cache of dl/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
+      - uses: kernelkit/actions/cache-restore@v1
        with:
-          path: dl/
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        if: ${{ inputs.use_cache }}
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
+          target: ${{ matrix.target }}
+          enabled: ${{ inputs.use_cache }}

      - name: Configure & Build
        env:
@@ -108,12 +86,12 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-${{ matrix.target }}
          path: output/*.tar.gz

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-disk-image-${{ matrix.target }}
          path: output/images/*.qcow2
@@ -78,18 +78,9 @@ jobs:
          rm -rf ./* || true
          rm -rf ./.??* || true
          ls -la ./
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -98,6 +89,8 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

+      - uses: kernelkit/actions/podman-cleanup@v1
+
      - name: Run pre-build script
        if: ${{ inputs.pre_build_script != '' }}
        run: |
@@ -127,22 +120,9 @@ jobs:
          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
          echo "Building target ${target}_defconfig"

-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
+      - uses: kernelkit/actions/cache-restore@v1
        with:
-          path: dl/
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ env.TARGET }}-
-            ccache-
+          target: ${{ env.TARGET }}

      - name: Configure ${{ env.TARGET }}
        run: |
@@ -153,10 +133,6 @@ jobs:
          podman rm -af || true
          pkill -9 -f rootlessport || true

-      - name: Unit Test ${{ env.TARGET }}
-        run: |
-          make test-unit
-
      - name: Prepare parallel build
        id: parallel
        run: |
@@ -202,7 +178,7 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.tgz }}
          name: artifact-${{ env.TARGET }}
@@ -12,7 +12,7 @@ jobs:

    steps:
      - name: Check out infix repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
@@ -103,7 +103,7 @@ jobs:

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
          script: |
@@ -8,13 +8,15 @@ on:
 env:
  PROJECT_NAME: Infix
  CONTACT_EMAIL: troglobit@gmail.com
+  LIBYANG_VERSION: 4.2.2
+  SYSREPO_VERSION: 4.2.10

 jobs:
  coverity:
    if: ${{github.repository_owner == 'kernelkit'}}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Fetch latest Coverity Scan MD5
        id: var
        env:
@@ -25,7 +27,7 @@ jobs:
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT

-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
        id: cache
        with:
          path: coverity-latest.tar.gz
@@ -55,16 +57,24 @@ jobs:
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libavahi-client-dev

      - name: Build dependencies
        run: |
-          git clone https://github.com/CESNET/libyang.git
+          git clone -b v${LIBYANG_VERSION} --depth 1 https://github.com/CESNET/libyang.git
+          for p in patches/libyang/${LIBYANG_VERSION}/*.patch; do
+            git -C libyang apply < "$p"
+          done
          mkdir libyang/build
          (cd libyang/build && cmake .. && make all && sudo make install)
-          git clone https://github.com/sysrepo/sysrepo.git
+
+          git clone -b v${SYSREPO_VERSION} --depth 1 https://github.com/sysrepo/sysrepo.git
+          for p in patches/sysrepo/${SYSREPO_VERSION}/*.patch; do
+            git -C sysrepo apply < "$p"
+          done
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
+
          git clone https://github.com/troglobit/libite.git
          (cd libite && ./autogen.sh && ./configure && make && sudo make install)
          make dep
@@ -88,7 +98,7 @@ jobs:
            https://scan.coverity.com/builds?project=${PROJECT_NAME}

      - name: Upload build.log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: coverity-build.log
          path: cov-int/build-log.txt
@@ -24,12 +24,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
        with:
          python-version: '3.x'

@@ -33,7 +33,7 @@ jobs:
            mtools

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.ref }}
@@ -77,7 +77,7 @@ jobs:
          ln -s Infix-x86_64 images
          tar cfz Infix-x86_64.tar.gz Infix-x86_64

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/Infix-x86_64.tar.gz
          name: artifact-x86_64
@@ -44,23 +44,11 @@ jobs:
  checkout:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
+      - uses: actions/checkout@v6
+      - uses: kernelkit/actions/cache-restore@v1
        with:
-          path: dl/
-          key: dl-netconf-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-netconf-
-            dl-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-x86_64-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-x86_64-
-            ccache-
+          target: x86_64
+          dl-prefix: dl-netconf
      - name: Disk inventory (2/2) ...
        run: |
          echo "df -h ========================================================================="
@@ -48,20 +48,12 @@ jobs:
      contents: write
      discussions: write
    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: 'true'

+      - uses: kernelkit/actions/podman-cleanup@v1
+
      - name: Set Release Variables
        id: rel
        run: |
@@ -86,7 +78,7 @@ jobs:
          echo "pre=${{ steps.rel.outputs.pre }}"
          echo "latest=${{ steps.rel.outputs.latest }}"

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -43,6 +43,11 @@ on:
        type: string
        default: ''
        description: 'Optional script to run after checkout (for spin customization)'
+      release:
+        required: false
+        type: string
+        default: ''
+        description: 'Release version (e.g. v26.04.0), sets INFIX_RELEASE so make test finds versioned artifacts'
    secrets:
      CHECKOUT_TOKEN:
        required: false
@@ -60,18 +65,8 @@ jobs:
    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
    runs-on: [self-hosted, regression]
    steps:
-      - name: Cleanup podman state
-        run: |
-          set -x
-          podman ps -a              || true
-          podman stop -a            || true
-          podman rm -a -f           || true
-          podman volume prune -f    || true
-          podman system prune -a -f || true
-          podman system migrate     || true
-
      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -80,6 +75,8 @@ jobs:
          submodules: recursive
          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}

+      - uses: kernelkit/actions/podman-cleanup@v1
+
      - name: Run pre-test script
        if: ${{ inputs.pre_test_script != '' }}
        run: |
@@ -101,7 +98,7 @@ jobs:
        run: |
          make ${{ env.TARGET }}_defconfig

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -113,12 +110,15 @@ jobs:

          ls -l
          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
+          tarfile=$(ls ${name}-${target}*.tar.gz | head -1)
+          mv "$tarfile" output/
          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
+          tar xf "$tarfile"
+          ln -s "${tarfile%.tar.gz}" images

      - name: Regression Test ${{ env.TARGET }}
+        env:
+          INFIX_RELEASE: ${{ inputs.release }}
        run: |
          if [ -n "$NINEPM_CONF" ]; then
            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
@@ -139,7 +139,7 @@ jobs:
          make test-dir="$(pwd)/$TEST_PATH" test-report

      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: test-report
          path: output/images/test-report.pdf
@@ -1,4 +1,4 @@
-name: Kernelkit Trigger
+name: CI

 on:
  pull_request:
@@ -28,6 +28,7 @@ jobs:
    outputs:
      x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
      aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
+      arm_target: ${{ steps.set-targets.outputs.arm_target }}
    steps:
      - run: |
          echo "Triggering build, logging meta data ..."
@@ -43,25 +44,40 @@ jobs:
             | grep -q "ci:main"; then
            echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
            echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
+            echo "arm_target=arm_minimal" >> $GITHUB_OUTPUT
          else
            echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
            echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
+            echo "arm_target=arm" >> $GITHUB_OUTPUT
          fi
+  unit-test:
+    needs: check-trigger
+    uses: ./.github/workflows/unit-test.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}

  build-x86_64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
      target: ${{ needs.check-trigger.outputs.x86_64_target }}

  build-aarch64:
-    needs: check-trigger
+    needs: [check-trigger, unit-test]
    uses: ./.github/workflows/build.yml
    with:
      name: "infix"
      target: ${{ needs.check-trigger.outputs.aarch64_target }}

+  build-arm:
+    needs: [check-trigger, unit-test]
+    uses: ./.github/workflows/build.yml
+    with:
+      name: "infix"
+      target: ${{ needs.check-trigger.outputs.arm_target }}
+
  test-run-x86_64:
    needs: [check-trigger, build-x86_64]
    uses: ./.github/workflows/test.yml
@@ -0,0 +1,116 @@
+name: unit-test
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Build target (e.g. aarch64 or aarch64_minimal)"
+        default: "x86_64"
+        type: string
+      parallel:
+        description: 'Massive parallel build of each image'
+        default: true
+        type: boolean
+      name:
+        description: "Name (for spin overrides)"
+        default: "infix"
+        type: string
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        default: kernelkit/infix
+        type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
+      parallel:
+        required: false
+        type: boolean
+        default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
+
+env:
+  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
+  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
+
+jobs:
+  unit-tests:
+    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    runs-on: [ self-hosted, latest ]
+    env:
+      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Cleanup Build Folder
+        run: |
+          ls -la ./
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+          ls -la ./
+
+      - name: Checkout infix repo
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - uses: kernelkit/actions/podman-cleanup@v1
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
+
+      - uses: kernelkit/actions/cache-restore@v1
+        with:
+          target: ${{ env.TARGET }}
+
+      - name: Configure ${{ env.TARGET }}
+        run: |
+          make ${{ env.TARGET }}_defconfig
+
+      - name: Cleanup stale containers and ports
+        run: |
+          podman rm -af || true
+          pkill -9 -f rootlessport || true
+
+      - name: Unit Test ${{ env.TARGET }}
+        run: |
+          make test-unit
@@ -22,7 +22,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v6
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -2,6 +2,7 @@
 .claude
 .gdb_history
 .claude
+AGENTS.md
 /.backup
 /.ccache
 /dl
@@ -11,4 +12,3 @@
 /test/.log
 /local.mk
 /test/spec/Readme.adoc
-
@@ -9,8 +9,10 @@ O    ?= output
 # otherwise treat it as relative to ./buildroot.
 override O := $(if $(filter /%,$O),$O,$(CURDIR)/$O)

-config := $(O)/.config
-bmake   = $(MAKE) -C buildroot O=$(O) $1
+config      := $(O)/.config
+bmake        = $(MAKE) -C buildroot O=$(O) $1
+SNIPPETS_DIR := $(CURDIR)/configs/snippets
+MERGE_CONFIG := $(CURDIR)/buildroot/support/kconfig/merge_config.sh


 all: $(config) buildroot/Makefile
@@ -26,6 +28,23 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1

+apply-%: $(SNIPPETS_DIR)/%.conf | $(config)
+	@KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $<
+	@+$(call bmake,olddefconfig)
+	@echo "Applied snippet: $<"
+
+list-snippets:
+	@echo "Available snippets (use 'make apply-<name>'):"
+	@ls $(SNIPPETS_DIR)/*.conf 2>/dev/null | sed 's|.*/||; s|\.conf$$||; s|^|  |'
+
+dev: | $(config)
+	@for s in $(SNIPPETS_DIR)/*.conf; do \
+		KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $$s; \
+		echo "Applied snippet: $$s"; \
+	done
+	@+$(call bmake,olddefconfig)
+	@+$(call bmake,all)
+
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

@@ -44,4 +63,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all check coverity dep test cyclonedx
+.PHONY: all check coverity dep test cyclonedx list-snippets dev
@@ -85,12 +85,12 @@ interfaces {
 admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
 admin@infix-12-34-56:/> <b>show interfaces</b>
 <u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-eth0            ethernet   UP          52:54:00:12:34:56
-                ipv4                   192.168.2.200/24 (static)
-                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                ipv4                   127.0.0.1/8 (static)
                ipv6                   ::1/128 (static)
+eth0            ethernet   UP          52:54:00:12:34:56
+                ipv4                   192.168.2.200/24 (static)
+                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>

@@ -114,6 +114,7 @@ containers for any custom functionality you need.
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support

@@ -167,13 +168,13 @@ APIs.
 [0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
-[3]: https://kernelkit.org/infix/latest/cli/introduction/
-[4]: https://kernelkit.org/infix/
-[5]: https://github.com/kernelkit/infix/releases
+[3]: https://www.kernelkit.org/infix/latest/cli/introduction/
+[4]: https://www.kernelkit.org/infix/
+[5]: https://github.com/kernelkit/infix/releases/latest
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
-[Release]:         https://github.com/kernelkit/infix/releases
+[Release]:         https://github.com/kernelkit/infix/releases/latest
 [Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
@@ -2,6 +2,8 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r4/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
@@ -4,8 +4,11 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi R3](banana-pi-r3/)
- [Marvell CN9130-CRB](cn9130-crb/)
- [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
- [NanoPi R2S](r2s/)
- [Raspberry Pi 64-bit](raspberry-pi64/)
+- [Banana Pi BPi-R3](bananapi-bpi-r3/)
+- [Banana Pi BPi-R4](bananapi-bpi-r4/)
+- [Banana Pi BPi-R64](bananapi-bpi-r64/)
+- [Marvell CN9130-CRB](marvell-cn9130-crb/)
+- [Marvell ESPRESSObin](marvell-espressobin/)
+- [Microchip SparX-5i PCB135 (eMMC)](microchip-sparx5-pcb135/)
+- [NanoPi R2S](friendlyarm-nanopi-r2s/)
+- [Raspberry Pi 64-bit](raspberrypi-rpi64/)
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_ALDER_ALDER
 	bool "Alder"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Alder
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -5,6 +5,7 @@ config BR2_PACKAGE_BANANAPI_BPI_R3
 	select BR2_PACKAGE_LINUX_FIRMWARE
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
 	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7986
+	select BR2_PACKAGE_LINUX_FIRMWARE_AIROHA_EN8811H
 	select SDCARD_AUX
 	help
 	  Build Banana PI R3 support
@@ -1,20 +1,29 @@
-# Banana Pi BPI-R3
+# Banana Pi BPI-R3 / BPI-R3 Mini

 <img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>

 ## Overview

-The Banana Pi R3 is a high-performance networking board with full Infix
-support for all enabled features including switched Ethernet ports, WiFi,
-and SFP interfaces.
+The Banana Pi BPI-R3 and BPI-R3 Mini are high-performance networking
+boards with full Infix support for all enabled features including
+Ethernet, WiFi, and SFP interfaces.
+
+Both boards share the same SoC and most peripherals.  The key
+differences are:
+
+| Feature         | BPI-R3             | BPI-R3 Mini             |
+|-----------------|--------------------|-------------------------|
+| Ethernet switch | Yes (4x LAN + WAN) | No (WAN/LAN ports only) |
+| SD card slot    | Yes                | No                      |

 ### Hardware Features

 - MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
 - 2 GB DDR4 RAM
- 8 GB eMMC storage + microSD card slot
- 5x Gigabit Ethernet ports (4x LAN, 1x WAN)
- 2x SFP cages for fiber connectivity (1G/2.5G)
+- 8 GB eMMC storage
+- microSD card slot (BPI-R3 only)
+- 5x Gigabit Ethernet ports with switch core (BPI-R3 only)
+- 2x SFP cages for fiber connectivity (1G/2.5G) (BPI-R3 only)
 - Dual-band WiFi (2.4 GHz + 5 GHz)
 - USB 3.0 port
 - Mini PCIe slot
@@ -23,16 +32,16 @@ and SFP interfaces.

 Infix comes preconfigured with:

- **LAN ports** (lan1-lan4): Bridged for internal networking
+- **LAN ports** (lan1-lan4): Bridged for internal networking (BPI-R3 only)
 - **WAN port**: DHCP client enabled for internet connectivity
- **SFP ports** (sfp1, sfp2): Available for configuration
+- **SFP ports** (sfp1, sfp2): Available for configuration (BPI-R3 only)
 - **WiFi interfaces** (wifi0, wifi1): Available for configuration

 ## Getting Started

-### Quick Start with SD Card
+### BPI-R3: Quick Start with SD Card

-The easiest way to get started is using an SD card:
+The easiest way to get started with the BPI-R3 is using an SD card:

 > [!NOTE]
 > SD card boot works but we have observed stability issues. For production
@@ -49,73 +58,63 @@ The easiest way to get started is using an SD card:
   - Connect to LAN port or console (115200 8N1)
   - Default login: `admin` / `admin`

+### BPI-R3 Mini: Getting Started
+
+The BPI-R3 Mini does not have an SD card slot, so you must install
+directly to eMMC.  See [Installing to eMMC — BPI-R3
+Mini](#bpi-r3-mini) below.
+
 ### Boot Switch Reference

 The BPI-R3 has a 4-position DIP switch that controls boot media:

 <img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>

-| Position | Mode        | Description                           |
-|----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
-| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+| ABCD | Mode     | Description                           |
+|------|----------|---------------------------------------|
+| 0000 | SD card  | Boot from microSD card                |
+| 0101 | SPI NAND | Boot from SPI NAND (advanced users)   |
+| 1001 | eMMC     | Boot from internal eMMC (recommended) |

 > [!NOTE]
-> Switch position is read from left to right: "0" = OFF, "1" = ON.  
+> Switch position is read from left to right: "0" = OFF, "1" = ON.
 > When the DIP switch is in the "UP" position it is OFF(0).

-## Advanced: Installing to eMMC
+## Installing to eMMC

 For production deployments or better performance, you can install Infix
-to the internal eMMC storage. This is more complex but provides faster
-boot times and eliminates the external SD card.
+to the internal eMMC storage.

 > [!IMPORTANT]
-> While Infix boots on both SD card and eMMC, we have observed stability
-> issues with SD cards on this platform. **eMMC is recommended** for
-> reliable operation.
-
-### Why Use eMMC?
-
-**Advantages:**
-
- More reliable than SD card (stability issues observed with SD cards)
- Faster boot and better performance
- No external SD card to manage
- More robust for industrial/embedded deployments
-
-**Disadvantages:**
-
- More complex installation process
- Requires intermediate NAND boot step
- Harder to recover from errors
+> While Infix boots on both SD card and eMMC on the BPI-R3, we have
+> observed stability issues with SD cards on this platform. **eMMC is
+> recommended** for reliable operation.

 ### Prerequisites

 - FTDI USB-to-serial cable (3.3V) for console access
- microSD card with Infix (for initial boot)
 - USB flash drive (FAT32 formatted)
+- microSD card with Infix, for initial boot (BPI-R3 only)
 - Downloaded files (see below)

 ### Required Files

 Download and place these files on a FAT32-formatted USB drive:

-1. **Intermediate NAND bootloader** (from Frank-W's U-Boot):
-   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
-   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
-2. **Infix eMMC image:**
+1. **Infix eMMC image:**
   - [infix-bpi-r3-emmc.img][3] (Complete system image)
-3. **eMMC bootloader** (extracted from):
+2. **eMMC bootloader** (extracted from):
   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
   - Extract `bl2.img` from the tarball to your USB drive
+3. **Intermediate NAND bootloader** (BPI-R3 only, from Frank-W's U-Boot):
+   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
+   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)

 > [!WARNING]
 > The following process involves multiple boot mode changes.  Take your
-> time verify each step carefully.
+> time and verify each step carefully.

-### Installation Steps
+### BPI-R3

 #### Step 1: Boot from SD card

@@ -151,6 +150,7 @@ From the U-Boot prompt:
 usb start
 fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
 setexpr blocks ${filesize} / 0x200
+mmc dev 0
 mmc write 0x50000000 0x0 ${blocks}
 ```

@@ -177,13 +177,48 @@ mmc partconf 0 1 1 0

 Your BPI-R3 should now boot Infix from internal eMMC storage!

+### BPI-R3 Mini
+
+The BPI-R3 Mini does not have an SD card slot, so you have to go
+through the factory-installed Linux (OpenWRT) to flash the Infix
+bootloader and OS to eMMC.
+
+#### Step 1: Boot from NAND (factory default)
+
+<img src="r3mini_nandboot2.png" alt="BPI-R3 Mini NAND boot switch position" width=400>
+
+1. Ensure boot switches are set to NAND mode (factory default)
+2. Place `infix-bpi-r3-emmc.img` and `bl2.img` on a USB drive
+3. Power on and boot into Linux
+4. Mount the USB drive to `/mnt`
+
+#### Step 2: Flash Infix to eMMC
+
+From the Linux shell:
+
+```
+echo 0 > /proc/sys/kernel/printk
+dd if=/mnt/infix-bpi-r3-emmc.img of=/dev/mmcblk0
+echo 0 > /sys/block/mmcblk0boot0/force_ro
+dd if=/mnt/bl2.img of=/dev/mmcblk0boot0
+sync
+```
+
+#### Step 3: Boot from eMMC
+
+<img src="r3mini_emmcboot.png" alt="BPI-R3 Mini eMMC boot switch position" width=400>
+
+1. Power off the board
+2. Set boot switches to eMMC mode (see image above)
+3. Power on
+
 ## Troubleshooting

 ### Board won't boot

 - Verify boot switch positions (check twice!)
 - Ensure power supply provides adequate current (12V/2A recommended)
- Try booting from SD card with switches at **0000**
+- Try booting from SD card with switches at **0000** (BPI-R3 only)

 ### Can't break into U-Boot

@@ -195,9 +230,9 @@ Your BPI-R3 should now boot Infix from internal eMMC storage!

 - Boot from NAND (**1010**) and verify eMMC image was written
 - Check USB drive contents - ensure all files are present
- Re-run Step 5 (eMMC boot configuration)
+- Re-run the eMMC boot configuration step

-### Reverting to SD card
+### Reverting to SD card (BPI-R3 only)

 Simply set boot switches back to **0000** and boot from SD card. The
 eMMC installation does not affect SD card functionality.
@@ -228,8 +263,8 @@ make aarch64
 ./utils/mkimage.sh -odt emmc bananapi-bpi-r3
 ```

-[0]: https://kernelkit.org/posts/flashing-sdcard/
-[1]: https://kernelkit.org/infix/latest/
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
 [2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
 [3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
 [4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -9,6 +9,7 @@ define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_SET_OPT,CONFIG_AIR_EN8811H_PHY,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
 	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
@@ -1 +1 @@
-dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb mediatek/mt7986a-bananapi-bpi-r3-mini.dtb
@@ -1,2 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
@@ -0,0 +1,12 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3-mini.dts>
+
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
+
+&phy0 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+&phy1 {
+	compatible = "ethernet-phy-id03a2.a411";
+};
+
@@ -0,0 +1,2 @@
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"
@@ -1,2 +1,4 @@
+#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
+
 #include "mt7986a-bananapi-bpi-r3.dtsi"
 #include "mt7986a-bananapi-bpi-r3-sd.dtsi"
@@ -1,5 +1,3 @@
-#include <arm64/mediatek/mt7986a-bananapi-bpi-r3.dts>
-
 / {
 	chosen {
 		infix {
@@ -10,6 +8,33 @@
 		};
 	};
 };
+/*
+From 236317dd4e55512933dcdaec3d0b4a0824f5e5bd Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 10 Aug 2025 18:11:01 +0800
+Subject: [PATCH] arm64: dts: mediatek: mt7986: increase ATF reserved memory to
+ 256 kiB
+
+The latest Mediatek open-source Trusted Firmware-A project has
+reserved 256 KiB for BL2 and BL31. It is better to increase the
+reserved memory region in the Linux kernel to protect the data.
+
+https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/199-arm64-dts-mediatek-mt7986-increase-ATF-reserved-memo.patch
+*/
+&secmon_reserved {
+	reg = <0 0x43000000 0 0x40000>;
+};
+/*
+ * The T-PHY's pcie-phy sub-node only claims clk40m ("ref") in the SoC
+ * dtsi.  CLK_TOP_PCIE_PHY_SEL ("da_ref") is left unclaimed, so the
+ * kernel's clk_disable_unused late_initcall gates it — killing the
+ * PCIe REFCLK output to the endpoint mid-probe.  Wire it here so the
+ * clock stays enabled while the PHY is active.
+ */
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};

 &cpu_thermal {
 	/delete-node/ trips;
@@ -51,6 +51,11 @@ image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
                size = 4096s
        }

+	partition en8811h_fw {
+		size = 10M
+		image = "en8811h-fw.bin"
+	}
+
        partition aux {
                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
                image = "aux.ext4"
@@ -21,21 +21,21 @@
      {
        "name": "radio0",
        "class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
-	  "band": "2.4GHz",
-	  "channel": "auto"
-	 }
-     },
-     {
-	"name": "radio1",
-	"class": "infix-hardware:wifi",
-	"infix-hardware:wifi-radio": {
-	  "country-code": "DE",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
          "band": "5GHz",
          "channel": "auto"
+        }
      }
-    }
    ]
  },
  "ietf-interfaces:interfaces": {
@@ -130,7 +130,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -179,7 +180,7 @@
            }
          }
        },
-	"infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      },
@@ -195,7 +196,7 @@
            }
          }
        },
-       "infix-interfaces:bridge-port": {
+        "infix-interfaces:bridge-port": {
          "bridge": "br0"
        }
      }
@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add
@@ -0,0 +1,446 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      },
+      {
+        "name": "radio1",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "5GHz",
+          "channel": "auto"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R3"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "wifi1-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio1",
+          "access-point": {
+            "ssid": "Infix5Ghz",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth0", NAME="lan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"
@@ -3,6 +3,9 @@ CONFIG_BOOTDELAY=2
 # CONFIG_MMC_PCI is not set
 CONFIG_ENV_IS_NOWHERE=y
 # CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_MULTI_DTB_FIT=y
+CONFIG_OF_LIST="mt7986a-bpi-r3-sd mt7986a-bpi-r3-emmc mt7986a-bpi-r3-mini"
+
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MTK=y
@@ -26,8 +29,17 @@ CONFIG_MTD_SPI_NAND=y
 CONFIG_MTK_SPIM=y
 CONFIG_MTK_SNOR=y

+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_PHY_AIROHA=y
+CONFIG_PHY_AIROHA_EN8811H=y
+CONFIG_PHY_AIROHA_FW_IN_MMC=y
+
 CONFIG_CMD_SF=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_MTD=y
+CONFIG_CMD_MDIO=y
 CONFIG_CMD_MTDPARTS=y
 CONFIG_CMD_DM=y
@@ -15,6 +15,10 @@
                       scriptaddr = "0x48000000";
                       ramdisk_addr_r = "0x4A000000";

+		en8811h_fw_part = "0#en8811h_fw";
+		en8811h_fw_dm_dir = "EthMD32.dm.bin";
+		en8811h_fw_dsp_dir = "EthMD32.DSP.bin";
+
                       /* This is a development platform, keep
                        * developer mode statically enabled.
                        */
@@ -0,0 +1,11 @@
+config BR2_PACKAGE_BANANAPI_BPI_R4
+	bool "Banana Pi R4"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_LINUX_FIRMWARE
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7988
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7996
+	select SDCARD_AUX
+	help
+	  Build Banana PI R4 support
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,360 @@
+# Banana Pi BPI-R4 / BPI-R4-2g5 / BPI-R4P
+
+<img src="banana_pi_bpi-r4_poe.jpg" alt="The board" width=800 padding=10>
+
+## Overview
+
+The Banana Pi BPI-R4 is a high-performance networking board built around the
+MediaTek MT7988A SoC (Filogic 880).  It is a successor to the BPI-R3 and
+represents a significant step up: the CPU switches from in-order Cortex-A53
+cores to out-of-order Cortex-A73 cores, and the MT7531 switch is now part of
+the SOC. The base model comes with two SFP+ cages supporting 1.25/2.5/5/10
+Gbps, and the R4P model comes with one SFP+ cage and one 2.5 Gbps RJ45 jack,
+which with an optional PoE board means the board can act as PD.  Unlike the
+BPi-R3, however, there is no on-board WiFi support, that requires an external
+tri-band WiFi 7 (IEEE 802.11be) card.
+
+### Variants
+
+| **Feature**      | **BPI-R4**       | **BPI-R4-2g5**    | **BPI-R4P**               |
+|------------------|------------------|-------------------|---------------------------|
+| 1G switch ports  | wan, lan1–lan3   | lan0–lan3         | lan0–lan3                 |
+| 2.5G RJ45 (WAN)  | —                | wan               | wan (PoE input)           |
+| SFP+ port(s)     | sfp1, sfp2 (10G) | sfp1 (10G)        | sfp1 (10G)                |
+| Linux DT         | bpi-r4           | bpi-r4-2g5        | bpi-r4-2g5 (same)         |
+
+On the standard BPI-R4 the four 1G switch ports are labeled `wan`, `lan1`, `lan2`,
+and `lan3`.  On the R4-2g5 and R4P, the port that would otherwise be `wan` on the
+switch is relabeled `lan0` via a device tree overlay, since the actual WAN port on
+those variants is the dedicated 2.5G internal PHY on the separate RJ45 jack.
+
+The BPI-R4P is mechanically and electrically identical to the BPI-R4-2g5
+with an additional PoE daughterboard header.  From a Linux kernel and
+Infix perspective the two boards are treated identically.
+
+### SoC: MediaTek MT7988A vs MT7986 (BPI-R3)
+
+The MT7988A (Filogic 880) and MT7986 (Filogic 820) may look similar from
+their part numbers, but they are built on entirely different silicon with
+distinct system architectures:
+
+| **Aspect**       | **MT7988A (BPI-R4)**     | **MT7986 (BPI-R3)**       |
+|------------------|--------------------------|---------------------------|
+| CPU cores        | 4x Cortex-A73 @ 1.8 GHz  | 4x Cortex-A53 @ 2.0 GHz   |
+| CPU architecture | ARMv8-A, out-of-order    | ARMv8-A, in-order         |
+| Internal switch  | 1 Gbps per port          | 1 Gbps per port           |
+| Uplinks          | USXGMII (native 10 Gbps) | USXGMII (native 2.5 Gbps) |
+| WiFi             | MT7996E PCIe module      | MT7915E (built-in)        |
+| WiFi standard    | WiFi 7 (802.11be)        | WiFi 6 (802.11ax)         |
+| WiFi bands       | 2.4 / 5 / 6 GHz          | 2.4 / 5 GHz               |
+| Hardware crypto  | EIP-197 NPU              | EIP-93                    |
+| PCIe slots       | 4 (2x mPCIe, 2x M.2)     | 1 mPCIe                   |
+| Boot ROM offset  | Sector 1024 (0x80000)    | Sector 1024 (0x80000)     |
+
+### Hardware Features
+
+- **SoC:** MediaTek MT7988A (Filogic 880)
+- **CPU:** Quad-core ARM Cortex-A73, up to 1.8 GHz
+- **RAM:** 4 GB DDR4
+- **Storage:** 8 GB eMMC, microSD card slot, SPI NAND flash
+- **Ethernet switch:** 4-port 1 GbE (10/100/1000) internal DSA switch
+- **SFP+ ports:** 2x 10 Gbps USXGMII (standard R4) or 1x SFP+ (R4-2g5/R4P)
+- **WiFi:** optional MediaTek MT7996E PCIe module — tri-band WiFi 7 (2.4/5/6 GHz)
+- **USB:** 1x USB 3.0 (xHCI)
+- **PCIe:** 2x mPCIe (SIM2/SIM3), 1x M.2 Key-B (SIM1), 1x M.2 Key-M (SSD)
+- **RTC:** PCF8563 on I2C
+- **Fan:** PWM-controlled cooling with thermal management
+- **Console:** UART at 115200 8N1 (3.3 V, USB-to-serial adapter required)
+
+### Default Network Configuration
+
+Infix ships with the following factory defaults.
+
+**Standard BPI-R4:**
+
+- **LAN bridge** (`br0`, 192.168.0.1/24): `lan1`, `lan2`, `lan3` (1G switch ports)
+- **WAN port** (`wan`): DHCP client, used for internet uplink (1G switch port)
+- **SFP+ ports** (`sfp1`, `sfp2`): Present but unconfigured
+
+**BPI-R4-2g5 and BPI-R4P:**
+
+- **LAN bridge** (`br0`, 192.168.0.1/24): `lan0`, `lan1`, `lan2`, `lan3` (1G switch ports)
+- **WAN port** (`wan`): DHCP client, used for internet uplink (2.5G internal PHY)
+- **SFP+ port** (`sfp1`): Present but unconfigured
+
+> [!NOTE]
+> If an optional WiFi 7 (MT7996E) PCIe card is installed, the radio interfaces
+> are bridged into the LAN as access points.  WiFi is not included with the board
+> and is not part of the factory default configuration.
+
+
+## Getting Started
+
+<img align="right" src="console-header.png" alt="Console header pins" width=200 padding=10>
+
+### Quick Start with SD Card
+
+1. **Download the SD card image:** [infix-bpi-r4-sdcard.img][2]
+2. **Flash the image to an SD card:** see [this guide][0]
+3. **Set boot switches to SD card mode** (see Boot Switch Reference below)
+4. **Insert the SD card, connect power and a serial console (115200 8N1)**
+5. Default login: `admin` / `admin`
+
+### Boot Switch Reference
+
+<img align="right" src="bootstrap-sw3.png" alt="DIP switches" width=140 padding=10>
+
+The BPI-R4 has a 2-position DIP switch (SW3) that selects the boot media.
+Switch positions are printed on the board near the SD card slot.
+
+| A   | B   | Boot media (SW3) |
+|-----|-----|------------------|
+| OFF | ON  | SPI NAND         |
+| ON  | OFF | eMMC             |
+| ON  | ON  | SD card          |
+
+> [!NOTE]
+> "OFF" = switch in the UP position = logical 0.
+
+## Installing to eMMC
+
+For production use or better reliability, install Infix to the internal
+eMMC storage.
+
+> [!IMPORTANT]
+> The MT7988A has a single MMC controller that can only operate in one mode
+> (SD or eMMC) per boot session.  The SD card U-Boot cannot switch to eMMC
+> mode mid-session, so an intermediate NAND bootloader step is required to
+> write the eMMC — the same approach as BPi-R3.
+>
+> The MT7988A boot chain is: **BROM → BL2 → FIP (BL31 + U-Boot)**.  The FIP
+> (Firmware Image Package) bundles ARM Trusted Firmware (BL31) and U-Boot
+> together; it is not just a U-Boot binary.  When BL2 runs, it loads the FIP
+> from a fixed offset and hands off to BL31, which then jumps into U-Boot.
+>
+> The factory SPI NAND contains a minimal recovery U-Boot that only supports
+> TFTP — it has no USB command.  You cannot use it to load files from a USB
+> drive.  Similarly, the factory eMMC ships with a basic OpenWRT image.
+> You must first flash a full-featured U-Boot (from Frank-W) to SPI NAND via
+> the SD card U-Boot before you can write the eMMC.
+>
+> This process involves three boot mode changes and multiple flash operations.
+> Take your time and verify each step carefully.
+
+### Prerequisites
+
+- USB-to-serial adapter (3.3 V) for console access
+- USB flash drive (FAT32 formatted)
+- microSD card with Infix SD image, for initial boot
+- Downloaded files (see below)
+
+### Required Files
+
+Place these files on a FAT32-formatted USB drive:
+
+1. **Infix eMMC image:** [infix-bpi-r4-emmc.img][3]
+2. **eMMC bootloader** (from): [bpi-r4-emmc-boot-2026.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive
+3. **Intermediate NAND bootloader** from Frank-W's U-Boot (for BPI-R4, SPI NAND):
+   - [bpi-r4_spim-nand_bl2.img][13] — BL2 first-stage loader
+   - [bpi-r4_spim-nand_fip.bin][14] — FIP image (BL31 + U-Boot)
+
+### Step 1: Boot from SD card
+
+1. Set boot switches to **SD card mode** (SW3: A=ON, B=ON)
+2. Insert the SD card with the Infix image
+3. Power on and break into U-Boot (press Ctrl-C during countdown)
+
+### Step 2: Flash intermediate NAND bootloader
+
+This installs a full-featured U-Boot to SPI NAND so the board can load files
+from USB in the next step.  From the SD card U-Boot prompt:
+
+```
+usb start
+mtd erase spi-nand0
+fatload usb 0:1 0x50000000 bpi-r4_spim-nand_bl2.img
+mtd write spi-nand0 0x50000000 0x0 0x100000
+fatload usb 0:1 0x50000000 bpi-r4_spim-nand_fip.bin
+mtd write spi-nand0 0x50000000 0x580000 0x200000
+```
+
+### Step 3: Boot from NAND
+
+1. Power off the board
+2. Set boot switches to **SPI NAND mode** (SW3: A=OFF, B=ON)
+3. Power on — you should boot into U-Boot again
+
+### Step 4: Write Infix image to eMMC
+
+From the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x50000000 infix-bpi-r4-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc write 0x50000000 0x0 ${blocks}
+```
+
+### Step 5: Configure eMMC boot partition
+
+Write the BL2 bootloader to the eMMC boot partition:
+
+```
+mmc partconf 0 1 1 1
+mmc erase 0x0 0x400
+fatload usb 0:1 0x50000000 bl2.img
+mmc write 0x50000000 0x0 0x400
+mmc partconf 0 1 1 0
+```
+
+### Step 6: Boot from eMMC
+
+1. Power off the board
+2. Set boot switches to **eMMC mode** (SW3: A=ON, B=OFF)
+3. Remove the SD card (optional, recommended to verify eMMC boot)
+4. Power on
+
+Your BPI-R4 should now boot Infix from internal eMMC storage.
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify boot switch positions — double-check against the wiki
+- Ensure the power supply provides adequate current (12 V / 3 A recommended)
+- Check the serial console output at 115200 8N1
+
+### Can't break into U-Boot
+
+- Connect the serial console before powering on
+- Press Ctrl-C immediately when boot messages appear
+- Try power cycling and pressing Ctrl-C repeatedly during the countdown
+
+### eMMC boot fails after installation
+
+- Boot from NAND (SW3=ON) and verify the eMMC write completed without errors
+- Re-run the `mmc partconf` sequence — a missed step is the most common
+  cause of failure
+- Use `mmc info` to confirm the eMMC is detected
+
+### No network connectivity
+
+The interface names on BPI-R4 differ from BPI-R3.  Confirm what Linux
+has created with `ip link` and compare with the factory configuration:
+
+- `wan`, `lan1`–`lan3`: 1G switch ports (standard R4)
+- `wan`, `lan0`–`lan3`: on R4-2g5/R4P, `wan` is the 2.5G internal PHY; `lan0`–`lan3` are 1G switch ports
+- `sfp1` (and `sfp2` on standard R4): 10G SFP+ cage(s)
+
+If interface renames look wrong, check `dmesg | grep renamed` and if
+you spot any errors, please report as an issue to the Infix tracker
+on GitHub.
+
+## Board Variants
+
+### BPI-R4
+
+The base model BPi-R4 ports look like this, the `wan` port is the same physical
+switch port as `lan0` on the R4-2g5/R4P, but here it serves as the WAN port in
+the factory default configuration.
+
+```
+.-.
+| |                      .-----.-----.-----.-----.
+| |   _______   _______  |     |     |     |     | .---.
+| |  |       | |       | |     |     |     |     | |   | .-----.
+'-'  '-------' '-------' '-----'-----'-----'-----' '---' '-----'
+USB1    sfp1      sfp2     wan  lan1  lan2  lan3   DC12V  PD20V
+```
+
+### BPI-R4-2g5 and BPI-R4P
+
+These variants substitute one SFP+ cage for an internal 2.5 Gbps PHY
+connected to a standard RJ45 jack.  From a kernel perspective they use
+the `mt7988a-bananapi-bpi-r4-2g5` device tree.
+
+The BPI-R4P additionally supports an optional PoE input daughterboard on
+the 2.5 Gbps RJ45 port.  The PoE circuitry is passive with respect to
+Linux — no special kernel driver is required for basic operation.
+
+For these board variants, the WAN role moves to the dedicated 2.5G internal PHY,
+so all four switch ports become LAN ports (`lan0`–`lan3`) instead of three:
+
+```
+.-.
+| |            .-----.   .-----.-----.-----.-----.
+| |   _______  |     |   |     |     |     |     | .---.
+| |  |       | |     |   |     |     |     |     | |   | .-----.
+'-'  '-------' '-----'   '-----'-----'-----'-----' '---' '-----'
+USB1    sfp1     wan      lan0  lan1  lan2  lan3   DC12V  PD20V
+```
+
+### Selecting the Board Variant
+
+U-Boot cannot automatically distinguish the standard R4 from the R4-2g5/R4P at
+boot time (the on-board EEPROM is not programmed from factory).  Instead, the
+variant is read from the persistent U-Boot environment on the `aux` partition,
+and you have to set it manually using `fw_setenv` from a UNIX shell:
+
+```bash
+# For BPI-R4-2g5 or BPI-R4P (1x SFP+ + 1x 2.5 Gbps RJ45):
+sudo fw_setenv BOARD_VARIANT 2g5
+
+# To revert to the standard BPI-R4 (2x SFP+) clear the setting:
+sudo fw_setenv BOARD_VARIANT
+```
+
+> [!IMPORTANT]
+> The change takes effect on the next reboot.  No re-flashing is required, but
+> you may want to do a factory reset to activate the changes in your system
+> `startup-config`: `sudo factory -y` from shell, or the CLI.
+
+`fw_setenv` writes to the `uboot.env` file on the aux partition.  U-Boot
+reads this at every boot (before loading the kernel) and selects the
+matching device tree:
+
+| `BOARD_VARIANT` | Device tree loaded                |
+|-----------------|-----------------------------------|
+| *(unset)*       | `mt7988a-bananapi-bpi-r4.dtb`     |
+| `2g5`           | `mt7988a-bananapi-bpi-r4-2g5.dtb` |
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Official BPI-R4 Page][7]
+- [BPI-R4 Forum][8]
+- [Frank-W's site][9]
+- [Release Downloads][10]
+- [Bootloader Builds][11]
+
+## Building Custom Images
+
+```bash
+# Build bootloaders for SD and eMMC
+make x-bpi-r4-sd-boot
+make x-bpi-r4-emmc-boot
+
+# Build main system
+make aarch64
+
+# Create SD card image
+./utils/mkimage.sh -od bananapi-bpi-r4
+
+# Create eMMC image
+./utils/mkimage.sh -odt emmc bananapi-bpi-r4
+```
+
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r4-sdcard.img
+[3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r4-emmc.img
+[4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r4-emmc-boot-2026.01-latest.tar.gz
+[7]: https://docs.banana-pi.org/en/BPI-R4/BananaPi_BPI-R4
+[8]: https://forum.banana-pi.org/
+[9]: https://wiki.fw-web.de/doku.php?id=en:bpi-r4:start
+[10]: https://github.com/kernelkit/infix/releases/tag/latest
+[11]: https://github.com/kernelkit/infix/releases/tag/latest-boot
+[12]: https://github.com/frank-w/u-boot/releases
+[13]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_bl2.img
+[14]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_fip.bin
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -0,0 +1,49 @@
+define BANANAPI_BPI_R4_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7988)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7988)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_LVTS_THERMAL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_SOC_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MT7996E,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK_GEN3,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_SCPSYS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XSPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XFI_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCS_STANDALONE,y)
+	$(call KCONFIG_SET_OPT,CONFIG_PCS_MTK_USXGMII,y)
+	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_PWM_FAN,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MEDIATEK_2P5GE_PHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
+endef
+
+LINUX_DTS_MT7988 = $(LINUX_DIR)/arch/arm64/boot/dts/mediatek
+
+define BANANAPI_BPI_R4_KERNEL_DTBS_INSTALL_TARGET
+	@$(call MESSAGE,"Installing kernel DTBs and DTBOs for BPI-R4")
+	$(foreach f, \
+		mt7988a-bananapi-bpi-r4.dtb \
+		mt7988a-bananapi-bpi-r4-2g5.dtb \
+		mt7988a-bananapi-bpi-r4-sd.dtbo \
+		mt7988a-bananapi-bpi-r4-emmc.dtbo, \
+		$(INSTALL) -D $(LINUX_DTS_MT7988)/$(f) \
+			$(TARGET_DIR)/boot/mediatek/$(f)$(sep))
+endef
+BANANAPI_BPI_R4_POST_INSTALL_TARGET_HOOKS += BANANAPI_BPI_R4_KERNEL_DTBS_INSTALL_TARGET
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1,2 @@
+dtb-y += infix/bananapi,bpi-r4.dtbo
+dtb-y += infix/bananapi,bpi-r4-2g5.dtbo
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4-2g5";
+};
+
+/*
+ * On the 2g5 variant, GMAC1 uses the internal 2.5G PHY (eth1 renamed to
+ * "wan" by udev).  The switch's port0, which is labeled "wan" in the base
+ * DTS, would cause a name collision when the switch driver registers it.
+ * Rename it to "lan0" here so the kernel names it correctly from the start.
+ */
+&gsw_port0 {
+	label = "lan0";
+};
+
+/*
+ * The upstream mt7988a.dtsi sets compatible = "ethernet-phy-ieee802.3-c45"
+ * on the internal 2.5G PHY node.  That gives genphy_c45 (built-in) OF-match
+ * priority over the PHY-ID-based mtk-2p5ge driver, leaving the PHY powered
+ * down and unclaimed.  Replace it with the standard ethernet-phy-idXXXX.XXXX
+ * form so of_get_phy_id() registers the PHY as C22 with explicit ID 0x00339c11.
+ * mtk-2p5ge then matches via PHY_ID_MATCH_VENDOR(0x00339c00) instead of
+ * genphy_c45 winning via OF-match.
+ * Note: /delete-property/ is not used because U-Boot fdt apply does not
+ * implement property deletion in overlays.
+ */
+&int_2p5g_phy {
+	compatible = "ethernet-phy-id0033.9c11";
+};
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+};
+
+/*
+ * The upstream mt7988a-bananapi-bpi-r4.dtsi sets stdout-path = "serial0:..."
+ * but the aliases node there only has ethernet entries.  Linux resolves
+ * stdout-path by looking in /aliases, so we must add serial0 here.
+ * Path references in overlay aliases cannot use &label, so use the full path.
+ */
+&{/} {
+	aliases {
+		serial0 = "/soc/serial@11000000";
+	};
+
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			usb-ports = <&ssusb1>;
+			usb-port-names = "USB";
+		};
+	};
+};
@@ -0,0 +1,81 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-bpi-r4-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+                gpt-no-backup = true
+        }
+        # BL2 bootloader partition (MediaTek official location)
+	partition bl2 {
+		  image = "bl2.img"
+		  offset = 1024s   # 0x80000 = sector 1024
+		  size = 4M        # 0x400000
+		  bootable = true
+	}
+
+	# Factory/calibration data (sectors 9216-13311)
+	partition factory {
+		offset = 4608K  # 0x480000
+		size = 2M       # 0x200000
+	}
+
+	# FIP partition - BL31 + U-Boot (sectors 13312-17407)
+        partition fip {
+                image = "fip.bin"
+                offset = 13312s
+                size = 4096s
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtbo /boot/infix/bananapi,bpi-r4.dtbo /boot/infix/bananapi,bpi-r4-2g5.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-sd.dtbo /boot/infix/bananapi,bpi-r4.dtbo /boot/infix/bananapi,bpi-r4-2g5.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtbo /boot/infix/bananapi,bpi-r4.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-sd.dtbo /boot/infix/bananapi,bpi-r4.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,404 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R4"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,5 @@
+# The mtk-2p5ge PHY driver uses MDIO PHY ID matching, not OF compatible
+# matching.  udev auto-loading is based on MODALIAS, which for DT-described
+# devices is "of:N...C<compatible>" — a format that never matches the driver's
+# "mdio:..." module alias.  Match on OF_COMPATIBLE_0 explicitly instead.
+ACTION=="add", SUBSYSTEM=="mdio_bus", ENV{OF_COMPATIBLE_0}=="ethernet-phy-id0033.9c11", RUN+="/sbin/modprobe -b mtk-2p5ge"
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth2", NAME="sfp1"
@@ -0,0 +1,396 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R4"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="sfp2"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth2", NAME="sfp1"
@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-emmc-env.dtsi"
@@ -0,0 +1,40 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_MULTI_DTB_FIT=y
+CONFIG_OF_LIST="mt7988a-bananapi-bpi-r4 mt7988a-bananapi-bpi-r4-2g5"
+
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_USB_MTU3=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_MTK_SPIM=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_SPI_FLASH=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTK_SPIM=y
+CONFIG_MTK_SNOR=y
+
+CONFIG_BUTTON=y
+CONFIG_BUTTON_CMD=y
+CONFIG_BUTTON_GPIO=y
+
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,7 @@
+#include <mt7988-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7988a-bananapi-bpi-r4.dtb";
+      board   = "bananapi,bpi-r4-emmc";
+      ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; setenv board bananapi,bpi-r4-2g5-emmc; fi";
+};
@@ -0,0 +1,27 @@
+/ {
+       config {
+               env: environment {
+                       bootcmd = "run ixboot";
+                       boot_targets = "mmc0";
+                       ethprime = "eth0";
+                       fdt_addr_r = "0x43f00000";
+                       kernel_addr_r = "0x44000000";
+                       fdtoverlay_addr_r = "0x47f00000";
+                       scriptaddr = "0x48000000";
+                       ramdisk_addr_r = "0x4A000000";
+
+                       /*
+                        * Apply BOARD_VARIANT from aux uboot.env.
+                        * Infix writes BOARD_VARIANT=2g5 via fw_setenv on
+                        * BPI-R4-2g5 / BPI-R4P boards to select the correct
+                        * device tree.  Unset = standard R4 (2x SFP+).
+                        */
+                       ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; fi";
+
+                       /* This is a development platform, keep
+                        * developer mode statically enabled.
+                        */
+                       ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+               };
+       };
+};
@@ -0,0 +1,7 @@
+#include <mt7988-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7988a-bananapi-bpi-r4.dtb";
+      board   = "bananapi,bpi-r4-sdmmc";
+      ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; setenv board bananapi,bpi-r4-2g5-sdmmc; fi";
+};
@@ -0,0 +1,2 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-sd-env.dtsi"
+CONFIG_OF_LIST="mt7988a-bananapi-bpi-r4-sd"
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_BANANAPI_BPI_R64
+	bool "Banana Pi R64"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select SDCARD_AUX
+	help
+	  Build Banana PI R64 support
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,148 @@
+# Banana Pi BPI-R64
+
+## Overview
+
+<img align="right" src="banana_pi_bpi-r64_interface.jpg" alt="Board Overview" width=400 padding=10>
+
+The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
+(dual Cortex-A53, AArch64) SoC.
+
+### Hardware Features
+
+- MediaTek MT7622 ARM Cortex-A53 dual-core processor @ 1.35 GHz
+- 1 GB DDR3L RAM
+- 8 GB eMMC storage
+- microSD card slot
+- MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
+- MT7622 WMAC built-in 2.4 GHz 802.11ac WiFi
+- USB 3.0 port
+- 2x Mini PCIe slots
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan0-lan3): Bridged for internal networking
+- **WAN port**: DHCP client enabled for internet connectivity
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7622 WMAC, 2.4 GHz; or MT7615 PCIe card if fitted)
+
+## Boot Switch Reference
+
+<img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>
+
+The BPI-R64 has a 2-position DIP switch (SW1) for selecting the boot device.
+The MT7622 Boot ROM always tries SD first if a card is present, so you can
+leave SW1 in the OFF (eMMC) position and simply insert or remove an SD card
+to control boot device selection.
+
+| SW1 | Boot device |
+|-----|-------------|
+| OFF | eMMC        |
+| ON  | SD card     |
+
+## Getting Started
+
+### Quick Start with SD Card
+
+1. **Flash the image to an SD card** (the filename includes the version, e.g.
+   `infix-25.01-bpi-r64-sdcard.img`):
+
+<img align="right" src="debug-uart.png" alt="Debug UART" width=100 padding=10>
+
+   ```sh
+   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
+   ```
+
+2. **Insert SD card and power on**
+3. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
+   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
+4. **Default login:** `admin` / `admin`
+
+## Installing to eMMC
+
+Unlike the BPI-R3 (where SD and eMMC share a bus, requiring a NAND intermediate
+step), the BPI-R64 has separate controllers for SD (mmc1/MSDC1) and eMMC
+(mmc0/MSDC0).  You can write directly to eMMC while booted from SD.
+
+### eMMC Boot ROM Behaviour
+
+> [!IMPORTANT]
+> The MT7622 Boot ROM reads BL2 from the eMMC BOOT0 hardware partition (offset
+> 0), not from the User Data Area where the main disk image lives.  The
+> installation procedure below writes BL2 to BOOT0 separately to handle this.
+
+### Procedure
+
+Boot from SD and write the eMMC image from U-Boot using a FAT32-formatted USB
+drive.
+
+#### Step 1: Boot from SD card
+
+1. Insert SD card with Infix
+2. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Write the eMMC image from U-Boot
+
+Place `infix-bpi-r64-emmc.img` and `bl2.img` on a FAT32-formatted USB drive,
+then from the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x44000000 infix-bpi-r64-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc dev 0
+mmc write 0x44000000 0x0 ${blocks}
+```
+
+#### Step 3: Write BL2 to eMMC BOOT0
+
+```
+fatload usb 0:1 0x44000000 bl2.img
+mmc partconf 0 1 1 1
+setexpr blkcnt ${filesize} + 0x1ff
+setexpr blkcnt ${blkcnt} / 0x200
+mmc write 0x44000000 0x0 ${blkcnt}
+mmc partconf 0 1 1 0
+```
+
+#### Step 4: Boot from eMMC
+
+1. Power off the board
+2. Remove SD card and USB drive
+3. Power on
+
+## Platform Notes
+
+### WiFi
+
+The MT7622 SoC includes a built-in WMAC that provides 2.4 GHz 802.11b/g/n/ac
+(2×2) — there is no 5 GHz capability from the onboard radio.
+
+For dual-band operation, a PCIe card can be fitted in one of the two Mini PCIe
+slots.  The [Banana Pi BPI-MT7615][bpi-mt7615] is a purpose-built dual-band
+(2.4 + 5 GHz, 802.11ac 4×4) module designed for BPI router boards and is a
+natural fit.  With it installed, Infix will use it in preference to the onboard
+WMAC for the `wifi0-ap` interface.
+
+[bpi-mt7615]: https://docs.banana-pi.org/en/BPI-MT7615/BananaPi_MT7615
+
+### mmc0 = eMMC, mmc1 = SD
+
+On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
+4-bit SD card controller — the reverse of many other platforms.
+
+## Building
+
+```sh
+# Bootloader only (SD)
+make O=x-boot-bpir64-sd bpi_r64_sd_boot_defconfig && make O=x-boot-bpir64-sd
+
+# Bootloader only (eMMC)
+make O=x-boot-bpir64-emmc bpi_r64_emmc_boot_defconfig && make O=x-boot-bpir64-emmc
+
+# Compose SD image (pass the Infix rootfs output directory)
+utils/mkimage.sh -b x-boot-bpir64-sd -r x-aarch64/images bananapi-bpi-r64
+
+# Compose eMMC image
+utils/mkimage.sh -b x-boot-bpir64-emmc -r x-aarch64/images -t emmc bananapi-bpi-r64
+```
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -0,0 +1,35 @@
+define BANANAPI_BPI_R64_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7622)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	# Ethernet subsystem clock controller — required for the eth MAC,
+	# MT7531 DSA switch, and HSDMA to get their clocks from &ethsys.
+	# Without this, eth probe fails and the switch is never detected.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_ETHSYS)
+	# HIF subsystem clock controller — required for PCIe and USB.
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_MT7622_HIFSYS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MT7603E,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_SOC_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_MT7622)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1 @@
+dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb
@@ -0,0 +1,3 @@
+#include <arm64/mediatek/mt7622-bananapi-bpi-r64.dts>
+
+#include "mt7622-bananapi-bpi-r64.dtsi"
@@ -0,0 +1,10 @@
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			usb-ports = <&ssusb>;
+			usb-port-names = "USB";
+		};
+	};
+};
@@ -0,0 +1,89 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
+        hdimage {
+                partition-table-type = "hybrid"
+                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
+                # for the 0xEE protective entry.  Place it first so that BL2
+                # (with partition-type = 0x83) lands at MBR slot 1.
+                gpt-protective-first = true
+        }
+
+        # BL2 bootloader at sector 1024 (0x80000). The MT7622 Boot ROM scans
+        # the hybrid MBR for a bootable entry and loads BL2 from its offset.
+        # partition-type makes it visible in the MBR at slot 1 (slot 0 holds
+        # the 0xEE protective entry required by the TF-A partition driver).
+        partition bl2 {
+                partition-type = 0x83
+                image = "bl2.img"
+                offset = 1024s
+                size = 1024s
+                bootable = true
+        }
+
+        # Factory/calibration data at fixed offset
+        partition factory {
+                offset = 4608K
+                size = 2M
+        }
+
+        # FIP partition - BL31 + U-Boot
+        partition fip {
+                image = "fip.bin"
+                offset = 13312s
+                size = 4096s
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,438 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "name": "radio0",
+        "class": "infix-hardware:wifi",
+        "infix-hardware:wifi-radio": {
+          "country-code": "DE",
+          "band": "2.4GHz",
+          "channel": "auto"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R64"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0-ap",
+        "type": "infix-if-type:wifi",
+        "infix-interfaces:wifi": {
+          "radio": "radio0",
+          "access-point": {
+            "ssid": "Infix",
+            "security": {
+              "secret": "wifi"
+            }
+          }
+        },
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    },
+    "symmetric-keys": {
+      "symmetric-key": [
+        {
+          "name": "wifi",
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,14 @@
+# Rename MT7531 external switch ports by DT node path.
+
+# The DTS already contains this but it has been observed in the wild
+# that we may end up with names like lan118 rather than by DTS label,
+# so this set of rules, that run after most other rules, match on the
+# OF_FULLNAME which is a stable reference.
+#
+# MT7622 / BPI-R64 switch topology (switch@1f, ports):
+#   port@0 = wan, port@1..4 = lan0..lan3, port@5,6 = cpu
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@0", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@1", NAME="lan0"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@2", NAME="lan1"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@3", NAME="lan2"
+ACTION=="add", SUBSYSTEM=="net", ENV{OF_FULLNAME}=="*/switch@1f/ports/port@4", NAME="lan3"
@@ -0,0 +1,3 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_CMD_MMC_PARTCONF=y
@@ -0,0 +1,19 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_DM_MDIO=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY_ETHERNET_ID=y
+
+CONFIG_CMD_MDIO=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,5 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1,18 @@
+/ {
+	config {
+		env: environment {
+			bootcmd = "run ixboot";
+			boot_targets = "mmc0";
+			ethprime = "eth0";
+			fdt_addr_r = "0x43f00000";
+			kernel_addr_r = "0x44000000";
+			scriptaddr = "0x48000000";
+			ramdisk_addr_r = "0x4A000000";
+
+			/* This is a development platform, keep
+			 * developer mode statically enabled.
+			 */
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+		};
+	};
+};
@@ -0,0 +1,6 @@
+#include <mt7622-env.dtsi>
+
+&env {
+	boot_targets = "mmc1";   /* SD = mmc1 on MT7622 */
+	fdtfile = "mediatek/mt7622-bananapi-bpi-r64.dtb";
+};
@@ -0,0 +1,3 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_CMD_MMC_PARTCONF=y
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -71,7 +71,8 @@
                "id": "domain"
              },
              {
-                "id": "hostname"
+                "id": "hostname",
+                "value": "auto"
              },
              {
                "id": "dns-server"
@@ -1,3 +0,0 @@
-#!/bin/sh
-udevadm control --reload-rules
-udevadm trigger --subsystem-match=net --action=add
@@ -502,6 +502,7 @@ CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_CN9130_CRB
 	bool "Marvell CN9130-CRB"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Customer Reference Board for CN9130
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -1,5 +1,6 @@
 config BR2_PACKAGE_MARVELL_ESPRESSOBIN
 	bool "Marvell ESPRESSObin"
 	depends on BR2_aarch64
+	select BR2_PACKAGE_LINUX_FIRMWARE_INSIDE_SECURE_MINIFW
 	help
 	  Marvell ESPRESSObin
@@ -0,0 +1,232 @@
+# Marvell ESPRESSObin
+
+<img src="espressobin.png" alt="The board" width=800 padding=10>
+
+The [ESPRESSObin][0] is a single-board computer based on the [Marvell Armada
+3720][1] (dual Cortex-A53, AArch64) SoC and the [Marvell 88E6341][2] (Topaz)
+switch, oriented toward networking applications.
+
+The board design is old but the switch offers full Linux support, including
+advanced TSN features for [IEEE 1588-2019][3] (PTP) and [IEEE 802.1AS-2020][4]
+(gPTP).
+
+## Board Variants
+
+The board has gone through several hardware revisions:
+
+| Revision   | Storage             | Notes                          |
+|------------|---------------------|--------------------------------|
+| v1, v3, v5 | SPI NOR only        | Obsolete; U-Boot always in SPI |
+| v7         | SPI NOR + 4 GB eMMC | Current; SD and eMMC usable    |
+| Ultra      | SPI NOR + 4 GB eMMC | High-end variant               |
+
+On **all revisions** the Boot ROM is hardwired to load U-Boot from SPI NOR
+flash.  There is no strap or jumper to make the Boot ROM load directly from an
+SD card.  The SD card (or eMMC on v7/Ultra) is used only for the operating
+system.
+
+## Building
+
+The ESPRESSObin uses ext4 for its rootfs partitions rather than the default
+squashfs, because the stock SPI U-Boot lacks squashfs and `blkmap` support.
+The `ext4` configuration snippet enables this.  Apply it once after selecting
+the defconfig, then build and compose the SD card image:
+
+```sh
+make O=x-aarch64 aarch64_defconfig
+make O=x-aarch64 apply-ext4
+make O=x-aarch64
+
+utils/mkimage.sh -r x-aarch64 marvell-espressobin
+```
+
+The resulting image (`x-aarch64/images/infix-espressobin-sdcard.img`) contains
+a GPT disk with the standard Infix partition layout, using ext4 instead of the
+read-only squashfs:
+
+| Partition | Label     | Contents                     |
+|-----------|-----------|------------------------------|
+| 1         | aux       | RAUC upgrade state (ext4)    |
+| 2         | primary   | Rootfs slot primary (ext4)   |
+| 3         | secondary | Rootfs slot secondary (ext4) |
+| 4         | cfg       | Persistent config (ext4)     |
+| 5         | var       | Runtime data (ext4)          |
+
+## Writing to SD Card
+
+```sh
+dd if=infix-espressobin-sdcard.img of=/dev/sdX bs=4M status=progress conv=fsync
+```
+
+## Upgrading
+
+The build produces `x-aarch64/images/infix-aarch64-ext4.pkg`, a RAUC bundle
+containing the ext4 rootfs.  Once the board is running Infix, upgrade over the
+network in the usual way:
+
+```
+upgrade ftp://192.168.1.1/infix-aarch64-ext4.pkg
+```
+
+RAUC writes the new rootfs to the inactive slot, updates `BOOT_ORDER` in
+`/mnt/aux/uboot.env`, and the next boot picks it up automatically.
+
+> [!NOTE]
+> Use `infix-aarch64-ext4.pkg`, not the standard `infix-aarch64.pkg`.  The
+> standard bundle contains a squashfs rootfs which the stock U-Boot cannot
+> boot.
+
+## Booting with the Stock SPI U-Boot
+
+The stock Marvell U-Boot has `ext4load` and the standard variables
+(`$kernel_addr`, `$fdt_addr`, `$loadaddr`, `$console`, `$image_name`,
+`$fdt_name`) already set sensibly.  Connect to the board's console port, the
+micro USB connector, at 115200 8N1, interrupt autoboot, and paste the commands
+below.
+
+### Environment Variable Reference
+
+These variables are pre-set in the stock U-Boot environment.  Restore them
+with these values if they are ever lost or corrupted:
+
+```
+setenv kernel_addr  0x5000000
+setenv fdt_addr     0x4f00000
+setenv loadaddr     0x5000000
+setenv console      'console=ttyMV0,115200 earlycon=ar3700_uart,0xd0012000'
+setenv image_name   boot/Image
+setenv extra_params quiet
+```
+
+`$fdt_name` selects the device tree for your specific board revision:
+
+| Board revision | `fdt_name` value                                    |
+|----------------|-----------------------------------------------------|
+| v3 / v5        | `boot/marvell/armada-3720-espressobin.dtb`          |
+| v7             | `boot/marvell/armada-3720-espressobin-v7.dtb`       |
+| Ultra          | `boot/marvell/armada-3720-espressobin-ultra.dtb`    |
+| v3/v5 eMMC     | `boot/marvell/armada-3720-espressobin-emmc.dtb`     |
+| v7 eMMC        | `boot/marvell/armada-3720-espressobin-v7-emmc.dtb`  |
+
+```
+setenv fdt_name boot/marvell/armada-3720-espressobin.dtb   # adjust for your board
+```
+
+### Simple Boot
+
+Fixed boot from the primary slot, useful for initial bring-up:
+
+```
+setenv bootcmd 'mmc dev 0; \
+  ext4load mmc 0:2 $kernel_addr $image_name; \
+  ext4load mmc 0:2 $fdt_addr $fdt_name; \
+  setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+  booti $kernel_addr - $fdt_addr'
+saveenv
+```
+
+### Automatic Slot Selection (RAUC Integration)
+
+The CLI `upgrade` command writes to the inactive slot and updates `uboot.env`
+on the `aux` partition with the new boot order.  On the next boot U-Boot reads
+`BOOT_ORDER` from the aux partition and selects the appropriate slot.  The
+setup below also defines `bootcmd_primary`, `bootcmd_secondary`, and
+`bootcmd_net` for manual use (see [Manual Slot Selection](#manual-slot-selection)
+and [Netbooting](#netbooting)):
+
+```
+setenv bootcmd_boot \
+  'mmc dev 0; \
+   ext4load mmc 0:$bootpart $kernel_addr $image_name; \
+   ext4load mmc 0:$bootpart $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=$bootslot rw rootwait $extra_params rauc.slot=$bootslot; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd_primary   'setenv bootpart 2; setenv bootslot primary;   run bootcmd_boot'
+setenv bootcmd_secondary 'setenv bootpart 3; setenv bootslot secondary; run bootcmd_boot'
+
+setenv bootcmd_net \
+  'dhcp $kernel_addr $image_name; \
+   tftpboot $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd \
+  'setenv bootpart 2; setenv bootslot primary; setenv auxpart 1; \
+   if ext4load mmc 0:$auxpart $loadaddr /uboot.env; then \
+     env import -c $loadaddr $filesize BOOT_ORDER; \
+   fi; \
+   if test "$BOOT_ORDER" = "secondary primary" || \
+      test "$BOOT_ORDER" = "secondary primary net"; then \
+     setenv bootpart 3; setenv bootslot secondary; \
+   fi; \
+   if test "$BOOT_ORDER" = "net" || \
+      test "$BOOT_ORDER" = "net primary" || \
+      test "$BOOT_ORDER" = "net secondary primary"; then \
+     run bootcmd_net; \
+   fi; \
+   echo ">> Booting $bootslot from mmc 0:$bootpart ..."; \
+   run bootcmd_boot'
+
+saveenv
+```
+
+### Manual Slot Selection
+
+To boot a specific slot without waiting for the autoboot countdown, interrupt
+the bootloader (press any key) and run one of the convenience commands defined
+above:
+
+```
+run bootcmd_primary      # boot from primary   (partition 2)
+run bootcmd_secondary    # boot from secondary (partition 3)
+run bootcmd_net          # netboot via DHCP/TFTP
+```
+
+You can also force a permanent change to which slot boots next by setting
+`BOOT_ORDER` directly from Linux (the change persists across reboots):
+
+```sh
+fw_setenv BOOT_ORDER "secondary primary"   # next boot: secondary
+fw_setenv BOOT_ORDER "primary secondary"   # next boot: primary  (default)
+```
+
+### Netbooting
+
+The stock U-Boot supports TFTP.  This is useful for testing a new kernel or
+device tree without reflashing the SD card.  Set up a TFTP server with the
+contents of the Infix `boot/` directory (from the built rootfs at
+`x-aarch64/target/boot/`) and configure the variables:
+
+```
+setenv serverip 192.168.1.1    # IP of your TFTP server
+setenv ipaddr   192.168.1.100  # board IP (omit if using dhcp)
+saveenv
+```
+
+Then netboot manually:
+
+```
+run bootcmd_net
+```
+
+`bootcmd_net` uses `dhcp` to obtain an IP address and the `$serverip` from
+the DHCP server (option 66), then downloads `$image_name` and `$fdt_name`
+via TFTP.  The kernel mounts the primary SD card slot as root, so the SD
+card must still be present.
+
+To make netbooting the default on next boot (e.g. for iterative kernel
+development), set `BOOT_ORDER` from Linux:
+
+```sh
+fw_setenv BOOT_ORDER "net primary secondary"
+```
+
+This causes `bootcmd` to attempt netboot first; on failure it falls through
+to the primary slot on the SD card.
+
+[0]: https://wiki.espressobin.net/
+[1]: https://www.marvell.com/content/dam/marvell/en/public-collateral/embedded-processors/marvell-embedded-processors-armada-37xx-hardware-specifications.pdf
+[2]: https://www.marvell.com/content/dam/marvell/en/public-collateral/switching/marvell-link-street-88E6341-product-brief.pdf
+[3]: https://standards.ieee.org/ieee/1588/6825/
+[4]: https://standards.ieee.org/ieee/802.1AS/7121/
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-emmc-env.dtsi"`
				`@@ -0,0 +1 @@`
				`dtb-y += mediatek/mt7622-bananapi-bpi-r64.dtb`