Merge pull request #1487 from kernelkit/releng

.github: set INFIX_RELEASE when running release tests
Without INFIX_RELEASE, make test resolves INFIX_ARTIFACT to the unversioned infix-x86_64, but release builds produce versioned artifacts (infix-x86_64-v26.04.0-rc1.qcow2 etc.), causing the test environment to fail with "No such file or directory". [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2026-07-22 01:13:00 +02:00 · 2026-04-30 18:53:48 +02:00 · 2026-04-30 18:34:35 +02:00 · 2026-04-30 16:08:51 +02:00 · 2026-04-30 14:45:44 +02:00 · 2026-04-30 13:45:35 +02:00
385 changed files with 20708 additions and 901 deletions
@@ -16,7 +16,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Validate release version format
      id: validate
@@ -170,7 +170,7 @@ jobs:
        fi

    - name: Upload signed artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: signed-infix-${{ steps.validate.outputs.file_version }}
        path: ${{ steps.download_signed.outputs.signed_filename }}
@@ -212,4 +212,4 @@ jobs:
        ---

        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
-        EOF
+        EOF
@@ -19,6 +19,8 @@ jobs:
          - aarch64_qemu_boot
          - bpi_r3_sd_boot
          - bpi_r3_emmc_boot
+          - bpi_r4_sd_boot
+          - bpi_r4_emmc_boot
          - bpi_r64_sd_boot
          - bpi_r64_emmc_boot
          - cn9130_crb_boot
@@ -39,7 +41,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
          clean: true
@@ -94,7 +96,7 @@ jobs:
          mv images ${{ steps.vars.outputs.dirname }}
          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.archive }}
          name: artifact-${{ matrix.defconfig }}
@@ -106,7 +108,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -11,6 +11,7 @@ on:
          - raspberrypi-rpi2
          - raspberrypi-rpi64
          - bananapi-bpi-r3
+          - bananapi-bpi-r4
          - bananapi-bpi-r64
          - friendlyarm-nanopi-r2s
          - microchip-sama7g54-ek
@@ -22,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          clean: true
          fetch-depth: 0
@@ -68,6 +69,12 @@ jobs:
              echo "ARCH=aarch64" >> $GITHUB_ENV
              echo "BUILD_EMMC=true" >> $GITHUB_ENV
              ;;
+            bananapi-bpi-r4)
+              echo "BOOTLOADER_SD=bpi-r4-sd-boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi-r4-emmc-boot" >> $GITHUB_ENV
+              echo "ARCH=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
            bananapi-bpi-r64)
              echo "BOOTLOADER_SD=bpi-r64-sd-boot" >> $GITHUB_ENV
              echo "BOOTLOADER_EMMC=bpi-r64-emmc-boot" >> $GITHUB_ENV
@@ -270,7 +277,7 @@ jobs:
          fi

      - name: Upload images as artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: images-${{ inputs.board }}
          path: |
@@ -23,7 +23,7 @@ jobs:
        target: [aarch64, arm, x86_64]
      fail-fast: false
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          clean: true
          submodules: recursive
@@ -86,12 +86,12 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-${{ matrix.target }}
          path: output/*.tar.gz

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: artifact-disk-image-${{ matrix.target }}
          path: output/images/*.qcow2
@@ -80,7 +80,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -178,7 +178,7 @@ jobs:
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/${{ steps.vars.outputs.tgz }}
          name: artifact-${{ env.TARGET }}
@@ -12,7 +12,7 @@ jobs:

    steps:
      - name: Check out infix repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
@@ -103,7 +103,7 @@ jobs:

      - name: Create pull request
        if: steps.check.outputs.new_release == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
          script: |
@@ -16,7 +16,7 @@ jobs:
    if: ${{github.repository_owner == 'kernelkit'}}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - name: Fetch latest Coverity Scan MD5
        id: var
        env:
@@ -27,7 +27,7 @@ jobs:
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT

-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
        id: cache
        with:
          path: coverity-latest.tar.gz
@@ -98,7 +98,7 @@ jobs:
            https://scan.coverity.com/builds?project=${PROJECT_NAME}

      - name: Upload build.log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: coverity-build.log
          path: cov-int/build-log.txt
@@ -24,12 +24,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
        with:
          python-version: '3.x'

@@ -33,7 +33,7 @@ jobs:
            mtools

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.ref }}
@@ -77,7 +77,7 @@ jobs:
          ln -s Infix-x86_64 images
          tar cfz Infix-x86_64.tar.gz Infix-x86_64

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          path: output/Infix-x86_64.tar.gz
          name: artifact-x86_64
@@ -44,7 +44,7 @@ jobs:
  checkout:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
      - uses: kernelkit/actions/cache-restore@v1
        with:
          target: x86_64
@@ -40,15 +40,23 @@ jobs:
      version: ${{ needs.set-version.outputs.version }}
      use_cache: true

+  test:
+    needs: [build, set-version]
+    uses: ./.github/workflows/test.yml
+    with:
+      target: x86_64
+      name: infix
+      release: ${{ needs.set-version.outputs.version }}
+
  release:
    name: Release Infix ${{ github.ref_name }}
-    needs: build
+    needs: [build, test]
    runs-on: [self-hosted, release]
    permissions:
      contents: write
      discussions: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: 'true'

@@ -78,7 +86,7 @@ jobs:
          echo "pre=${{ steps.rel.outputs.pre }}"
          echo "latest=${{ steps.rel.outputs.latest }}"

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -43,6 +43,11 @@ on:
        type: string
        default: ''
        description: 'Optional script to run after checkout (for spin customization)'
+      release:
+        required: false
+        type: string
+        default: ''
+        description: 'Release version (e.g. v26.04.0), sets INFIX_RELEASE so make test finds versioned artifacts'
    secrets:
      CHECKOUT_TOKEN:
        required: false
@@ -61,7 +66,7 @@ jobs:
    runs-on: [self-hosted, regression]
    steps:
      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -93,7 +98,7 @@ jobs:
        run: |
          make ${{ env.TARGET }}_defconfig

-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -105,12 +110,15 @@ jobs:

          ls -l
          mkdir -p output
-          mv ${name}-${target}.tar.gz output/
+          tarfile=$(ls ${name}-${target}*.tar.gz | head -1)
+          mv "$tarfile" output/
          cd output/
-          tar xf ${name}-${target}.tar.gz
-          ln -s ${name}-${target} images
+          tar xf "$tarfile"
+          ln -s "${tarfile%.tar.gz}" images

      - name: Regression Test ${{ env.TARGET }}
+        env:
+          INFIX_RELEASE: ${{ inputs.release }}
        run: |
          if [ -n "$NINEPM_CONF" ]; then
            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
@@ -131,7 +139,7 @@ jobs:
          make test-dir="$(pwd)/$TEST_PATH" test-report

      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: test-report
          path: output/images/test-report.pdf
@@ -78,7 +78,7 @@ jobs:
          ls -la ./

      - name: Checkout infix repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.INFIX_REPO }}
          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
@@ -22,7 +22,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v6
        with:
          pattern: "artifact-*"
          merge-multiple: true
@@ -9,8 +9,10 @@ O    ?= output
 # otherwise treat it as relative to ./buildroot.
 override O := $(if $(filter /%,$O),$O,$(CURDIR)/$O)

-config := $(O)/.config
-bmake   = $(MAKE) -C buildroot O=$(O) $1
+config      := $(O)/.config
+bmake        = $(MAKE) -C buildroot O=$(O) $1
+SNIPPETS_DIR := $(CURDIR)/configs/snippets
+MERGE_CONFIG := $(CURDIR)/buildroot/support/kconfig/merge_config.sh


 all: $(config) buildroot/Makefile
@@ -26,6 +28,23 @@ $(config):
 	@echo "'make <board>_defconfig' before building an image."
 	@exit 1

+apply-%: $(SNIPPETS_DIR)/%.conf | $(config)
+	@KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $<
+	@+$(call bmake,olddefconfig)
+	@echo "Applied snippet: $<"
+
+list-snippets:
+	@echo "Available snippets (use 'make apply-<name>'):"
+	@ls $(SNIPPETS_DIR)/*.conf 2>/dev/null | sed 's|.*/||; s|\.conf$$||; s|^|  |'
+
+dev: | $(config)
+	@for s in $(SNIPPETS_DIR)/*.conf; do \
+		KCONFIG_CONFIG=$(config) $(MERGE_CONFIG) -m $(config) $$s; \
+		echo "Applied snippet: $$s"; \
+	done
+	@+$(call bmake,olddefconfig)
+	@+$(call bmake,all)
+
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

@@ -44,4 +63,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init

-.PHONY: all check coverity dep test cyclonedx
+.PHONY: all check coverity dep test cyclonedx list-snippets dev
@@ -2,6 +2,7 @@ if BR2_aarch64

 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r4/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
@@ -4,9 +4,11 @@ aarch64
 Board Specific Documentation
 ----------------------------

- [Banana Pi BPi-R3](banana-pi-r3/)
- [Banana Pi BPi-R64](banana-pi-r64/)
- [Marvell CN9130-CRB](cn9130-crb/)
- [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
- [NanoPi R2S](r2s/)
- [Raspberry Pi 64-bit](raspberry-pi64/)
+- [Banana Pi BPi-R3](bananapi-bpi-r3/)
+- [Banana Pi BPi-R4](bananapi-bpi-r4/)
+- [Banana Pi BPi-R64](bananapi-bpi-r64/)
+- [Marvell CN9130-CRB](marvell-cn9130-crb/)
+- [Marvell ESPRESSObin](marvell-espressobin/)
+- [Microchip SparX-5i PCB135 (eMMC)](microchip-sparx5-pcb135/)
+- [NanoPi R2S](friendlyarm-nanopi-r2s/)
+- [Raspberry Pi 64-bit](raspberrypi-rpi64/)
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -70,11 +70,11 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:

 <img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>

-| Position | Mode        | Description                           |
-|----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card                |
-| 0110     | eMMC        | Boot from internal eMMC (recommended) |
-| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+| ABCD | Mode     | Description                           |
+|------|----------|---------------------------------------|
+| 0000 | SD card  | Boot from microSD card                |
+| 0101 | SPI NAND | Boot from SPI NAND (advanced users)   |
+| 1001 | eMMC     | Boot from internal eMMC (recommended) |

 > [!NOTE]
 > Switch position is read from left to right: "0" = OFF, "1" = ON.
@@ -150,6 +150,7 @@ From the U-Boot prompt:
 usb start
 fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
 setexpr blocks ${filesize} / 0x200
+mmc dev 0
 mmc write 0x50000000 0x0 ${blocks}
 ```

@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -24,6 +24,18 @@ https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/
 &secmon_reserved {
 	reg = <0 0x43000000 0 0x40000>;
 };
+/*
+ * The T-PHY's pcie-phy sub-node only claims clk40m ("ref") in the SoC
+ * dtsi.  CLK_TOP_PCIE_PHY_SEL ("da_ref") is left unclaimed, so the
+ * kernel's clk_disable_unused late_initcall gates it — killing the
+ * PCIe REFCLK output to the endpoint mid-probe.  Wire it here so the
+ * clock stays enabled while the PHY is active.
+ */
+&pcie_port {
+	clocks = <&clk40m>, <&topckgen CLK_TOP_PCIE_PHY_SEL>;
+	clock-names = "ref", "da_ref";
+};
+
 &cpu_thermal {
 	/delete-node/ trips;
 	/delete-node/ cooling-maps;
@@ -0,0 +1,11 @@
+config BR2_PACKAGE_BANANAPI_BPI_R4
+	bool "Banana Pi R4"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_LINUX_FIRMWARE
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7988
+	select BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7996
+	select SDCARD_AUX
+	help
+	  Build Banana PI R4 support
@@ -0,0 +1,13 @@
+Copyright (c) 2026 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
@@ -0,0 +1,360 @@
+# Banana Pi BPI-R4 / BPI-R4-2g5 / BPI-R4P
+
+<img src="banana_pi_bpi-r4_poe.jpg" alt="The board" width=800 padding=10>
+
+## Overview
+
+The Banana Pi BPI-R4 is a high-performance networking board built around the
+MediaTek MT7988A SoC (Filogic 880).  It is a successor to the BPI-R3 and
+represents a significant step up: the CPU switches from in-order Cortex-A53
+cores to out-of-order Cortex-A73 cores, and the MT7531 switch is now part of
+the SOC. The base model comes with two SFP+ cages supporting 1.25/2.5/5/10
+Gbps, and the R4P model comes with one SFP+ cage and one 2.5 Gbps RJ45 jack,
+which with an optional PoE board means the board can act as PD.  Unlike the
+BPi-R3, however, there is no on-board WiFi support, that requires an external
+tri-band WiFi 7 (IEEE 802.11be) card.
+
+### Variants
+
+| **Feature**      | **BPI-R4**       | **BPI-R4-2g5**    | **BPI-R4P**               |
+|------------------|------------------|-------------------|---------------------------|
+| 1G switch ports  | wan, lan1–lan3   | lan0–lan3         | lan0–lan3                 |
+| 2.5G RJ45 (WAN)  | —                | wan               | wan (PoE input)           |
+| SFP+ port(s)     | sfp1, sfp2 (10G) | sfp1 (10G)        | sfp1 (10G)                |
+| Linux DT         | bpi-r4           | bpi-r4-2g5        | bpi-r4-2g5 (same)         |
+
+On the standard BPI-R4 the four 1G switch ports are labeled `wan`, `lan1`, `lan2`,
+and `lan3`.  On the R4-2g5 and R4P, the port that would otherwise be `wan` on the
+switch is relabeled `lan0` via a device tree overlay, since the actual WAN port on
+those variants is the dedicated 2.5G internal PHY on the separate RJ45 jack.
+
+The BPI-R4P is mechanically and electrically identical to the BPI-R4-2g5
+with an additional PoE daughterboard header.  From a Linux kernel and
+Infix perspective the two boards are treated identically.
+
+### SoC: MediaTek MT7988A vs MT7986 (BPI-R3)
+
+The MT7988A (Filogic 880) and MT7986 (Filogic 820) may look similar from
+their part numbers, but they are built on entirely different silicon with
+distinct system architectures:
+
+| **Aspect**       | **MT7988A (BPI-R4)**     | **MT7986 (BPI-R3)**       |
+|------------------|--------------------------|---------------------------|
+| CPU cores        | 4x Cortex-A73 @ 1.8 GHz  | 4x Cortex-A53 @ 2.0 GHz   |
+| CPU architecture | ARMv8-A, out-of-order    | ARMv8-A, in-order         |
+| Internal switch  | 1 Gbps per port          | 1 Gbps per port           |
+| Uplinks          | USXGMII (native 10 Gbps) | USXGMII (native 2.5 Gbps) |
+| WiFi             | MT7996E PCIe module      | MT7915E (built-in)        |
+| WiFi standard    | WiFi 7 (802.11be)        | WiFi 6 (802.11ax)         |
+| WiFi bands       | 2.4 / 5 / 6 GHz          | 2.4 / 5 GHz               |
+| Hardware crypto  | EIP-197 NPU              | EIP-93                    |
+| PCIe slots       | 4 (2x mPCIe, 2x M.2)     | 1 mPCIe                   |
+| Boot ROM offset  | Sector 1024 (0x80000)    | Sector 1024 (0x80000)     |
+
+### Hardware Features
+
+- **SoC:** MediaTek MT7988A (Filogic 880)
+- **CPU:** Quad-core ARM Cortex-A73, up to 1.8 GHz
+- **RAM:** 4 GB DDR4
+- **Storage:** 8 GB eMMC, microSD card slot, SPI NAND flash
+- **Ethernet switch:** 4-port 1 GbE (10/100/1000) internal DSA switch
+- **SFP+ ports:** 2x 10 Gbps USXGMII (standard R4) or 1x SFP+ (R4-2g5/R4P)
+- **WiFi:** optional MediaTek MT7996E PCIe module — tri-band WiFi 7 (2.4/5/6 GHz)
+- **USB:** 1x USB 3.0 (xHCI)
+- **PCIe:** 2x mPCIe (SIM2/SIM3), 1x M.2 Key-B (SIM1), 1x M.2 Key-M (SSD)
+- **RTC:** PCF8563 on I2C
+- **Fan:** PWM-controlled cooling with thermal management
+- **Console:** UART at 115200 8N1 (3.3 V, USB-to-serial adapter required)
+
+### Default Network Configuration
+
+Infix ships with the following factory defaults.
+
+**Standard BPI-R4:**
+
+- **LAN bridge** (`br0`, 192.168.0.1/24): `lan1`, `lan2`, `lan3` (1G switch ports)
+- **WAN port** (`wan`): DHCP client, used for internet uplink (1G switch port)
+- **SFP+ ports** (`sfp1`, `sfp2`): Present but unconfigured
+
+**BPI-R4-2g5 and BPI-R4P:**
+
+- **LAN bridge** (`br0`, 192.168.0.1/24): `lan0`, `lan1`, `lan2`, `lan3` (1G switch ports)
+- **WAN port** (`wan`): DHCP client, used for internet uplink (2.5G internal PHY)
+- **SFP+ port** (`sfp1`): Present but unconfigured
+
+> [!NOTE]
+> If an optional WiFi 7 (MT7996E) PCIe card is installed, the radio interfaces
+> are bridged into the LAN as access points.  WiFi is not included with the board
+> and is not part of the factory default configuration.
+
+
+## Getting Started
+
+<img align="right" src="console-header.png" alt="Console header pins" width=200 padding=10>
+
+### Quick Start with SD Card
+
+1. **Download the SD card image:** [infix-bpi-r4-sdcard.img][2]
+2. **Flash the image to an SD card:** see [this guide][0]
+3. **Set boot switches to SD card mode** (see Boot Switch Reference below)
+4. **Insert the SD card, connect power and a serial console (115200 8N1)**
+5. Default login: `admin` / `admin`
+
+### Boot Switch Reference
+
+<img align="right" src="bootstrap-sw3.png" alt="DIP switches" width=140 padding=10>
+
+The BPI-R4 has a 2-position DIP switch (SW3) that selects the boot media.
+Switch positions are printed on the board near the SD card slot.
+
+| A   | B   | Boot media (SW3) |
+|-----|-----|------------------|
+| OFF | ON  | SPI NAND         |
+| ON  | OFF | eMMC             |
+| ON  | ON  | SD card          |
+
+> [!NOTE]
+> "OFF" = switch in the UP position = logical 0.
+
+## Installing to eMMC
+
+For production use or better reliability, install Infix to the internal
+eMMC storage.
+
+> [!IMPORTANT]
+> The MT7988A has a single MMC controller that can only operate in one mode
+> (SD or eMMC) per boot session.  The SD card U-Boot cannot switch to eMMC
+> mode mid-session, so an intermediate NAND bootloader step is required to
+> write the eMMC — the same approach as BPi-R3.
+>
+> The MT7988A boot chain is: **BROM → BL2 → FIP (BL31 + U-Boot)**.  The FIP
+> (Firmware Image Package) bundles ARM Trusted Firmware (BL31) and U-Boot
+> together; it is not just a U-Boot binary.  When BL2 runs, it loads the FIP
+> from a fixed offset and hands off to BL31, which then jumps into U-Boot.
+>
+> The factory SPI NAND contains a minimal recovery U-Boot that only supports
+> TFTP — it has no USB command.  You cannot use it to load files from a USB
+> drive.  Similarly, the factory eMMC ships with a basic OpenWRT image.
+> You must first flash a full-featured U-Boot (from Frank-W) to SPI NAND via
+> the SD card U-Boot before you can write the eMMC.
+>
+> This process involves three boot mode changes and multiple flash operations.
+> Take your time and verify each step carefully.
+
+### Prerequisites
+
+- USB-to-serial adapter (3.3 V) for console access
+- USB flash drive (FAT32 formatted)
+- microSD card with Infix SD image, for initial boot
+- Downloaded files (see below)
+
+### Required Files
+
+Place these files on a FAT32-formatted USB drive:
+
+1. **Infix eMMC image:** [infix-bpi-r4-emmc.img][3]
+2. **eMMC bootloader** (from): [bpi-r4-emmc-boot-2026.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive
+3. **Intermediate NAND bootloader** from Frank-W's U-Boot (for BPI-R4, SPI NAND):
+   - [bpi-r4_spim-nand_bl2.img][13] — BL2 first-stage loader
+   - [bpi-r4_spim-nand_fip.bin][14] — FIP image (BL31 + U-Boot)
+
+### Step 1: Boot from SD card
+
+1. Set boot switches to **SD card mode** (SW3: A=ON, B=ON)
+2. Insert the SD card with the Infix image
+3. Power on and break into U-Boot (press Ctrl-C during countdown)
+
+### Step 2: Flash intermediate NAND bootloader
+
+This installs a full-featured U-Boot to SPI NAND so the board can load files
+from USB in the next step.  From the SD card U-Boot prompt:
+
+```
+usb start
+mtd erase spi-nand0
+fatload usb 0:1 0x50000000 bpi-r4_spim-nand_bl2.img
+mtd write spi-nand0 0x50000000 0x0 0x100000
+fatload usb 0:1 0x50000000 bpi-r4_spim-nand_fip.bin
+mtd write spi-nand0 0x50000000 0x580000 0x200000
+```
+
+### Step 3: Boot from NAND
+
+1. Power off the board
+2. Set boot switches to **SPI NAND mode** (SW3: A=OFF, B=ON)
+3. Power on — you should boot into U-Boot again
+
+### Step 4: Write Infix image to eMMC
+
+From the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x50000000 infix-bpi-r4-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc write 0x50000000 0x0 ${blocks}
+```
+
+### Step 5: Configure eMMC boot partition
+
+Write the BL2 bootloader to the eMMC boot partition:
+
+```
+mmc partconf 0 1 1 1
+mmc erase 0x0 0x400
+fatload usb 0:1 0x50000000 bl2.img
+mmc write 0x50000000 0x0 0x400
+mmc partconf 0 1 1 0
+```
+
+### Step 6: Boot from eMMC
+
+1. Power off the board
+2. Set boot switches to **eMMC mode** (SW3: A=ON, B=OFF)
+3. Remove the SD card (optional, recommended to verify eMMC boot)
+4. Power on
+
+Your BPI-R4 should now boot Infix from internal eMMC storage.
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify boot switch positions — double-check against the wiki
+- Ensure the power supply provides adequate current (12 V / 3 A recommended)
+- Check the serial console output at 115200 8N1
+
+### Can't break into U-Boot
+
+- Connect the serial console before powering on
+- Press Ctrl-C immediately when boot messages appear
+- Try power cycling and pressing Ctrl-C repeatedly during the countdown
+
+### eMMC boot fails after installation
+
+- Boot from NAND (SW3=ON) and verify the eMMC write completed without errors
+- Re-run the `mmc partconf` sequence — a missed step is the most common
+  cause of failure
+- Use `mmc info` to confirm the eMMC is detected
+
+### No network connectivity
+
+The interface names on BPI-R4 differ from BPI-R3.  Confirm what Linux
+has created with `ip link` and compare with the factory configuration:
+
+- `wan`, `lan1`–`lan3`: 1G switch ports (standard R4)
+- `wan`, `lan0`–`lan3`: on R4-2g5/R4P, `wan` is the 2.5G internal PHY; `lan0`–`lan3` are 1G switch ports
+- `sfp1` (and `sfp2` on standard R4): 10G SFP+ cage(s)
+
+If interface renames look wrong, check `dmesg | grep renamed` and if
+you spot any errors, please report as an issue to the Infix tracker
+on GitHub.
+
+## Board Variants
+
+### BPI-R4
+
+The base model BPi-R4 ports look like this, the `wan` port is the same physical
+switch port as `lan0` on the R4-2g5/R4P, but here it serves as the WAN port in
+the factory default configuration.
+
+```
+.-.
+| |                      .-----.-----.-----.-----.
+| |   _______   _______  |     |     |     |     | .---.
+| |  |       | |       | |     |     |     |     | |   | .-----.
+'-'  '-------' '-------' '-----'-----'-----'-----' '---' '-----'
+USB1    sfp1      sfp2     wan  lan1  lan2  lan3   DC12V  PD20V
+```
+
+### BPI-R4-2g5 and BPI-R4P
+
+These variants substitute one SFP+ cage for an internal 2.5 Gbps PHY
+connected to a standard RJ45 jack.  From a kernel perspective they use
+the `mt7988a-bananapi-bpi-r4-2g5` device tree.
+
+The BPI-R4P additionally supports an optional PoE input daughterboard on
+the 2.5 Gbps RJ45 port.  The PoE circuitry is passive with respect to
+Linux — no special kernel driver is required for basic operation.
+
+For these board variants, the WAN role moves to the dedicated 2.5G internal PHY,
+so all four switch ports become LAN ports (`lan0`–`lan3`) instead of three:
+
+```
+.-.
+| |            .-----.   .-----.-----.-----.-----.
+| |   _______  |     |   |     |     |     |     | .---.
+| |  |       | |     |   |     |     |     |     | |   | .-----.
+'-'  '-------' '-----'   '-----'-----'-----'-----' '---' '-----'
+USB1    sfp1     wan      lan0  lan1  lan2  lan3   DC12V  PD20V
+```
+
+### Selecting the Board Variant
+
+U-Boot cannot automatically distinguish the standard R4 from the R4-2g5/R4P at
+boot time (the on-board EEPROM is not programmed from factory).  Instead, the
+variant is read from the persistent U-Boot environment on the `aux` partition,
+and you have to set it manually using `fw_setenv` from a UNIX shell:
+
+```bash
+# For BPI-R4-2g5 or BPI-R4P (1x SFP+ + 1x 2.5 Gbps RJ45):
+sudo fw_setenv BOARD_VARIANT 2g5
+
+# To revert to the standard BPI-R4 (2x SFP+) clear the setting:
+sudo fw_setenv BOARD_VARIANT
+```
+
+> [!IMPORTANT]
+> The change takes effect on the next reboot.  No re-flashing is required, but
+> you may want to do a factory reset to activate the changes in your system
+> `startup-config`: `sudo factory -y` from shell, or the CLI.
+
+`fw_setenv` writes to the `uboot.env` file on the aux partition.  U-Boot
+reads this at every boot (before loading the kernel) and selects the
+matching device tree:
+
+| `BOARD_VARIANT` | Device tree loaded                |
+|-----------------|-----------------------------------|
+| *(unset)*       | `mt7988a-bananapi-bpi-r4.dtb`     |
+| `2g5`           | `mt7988a-bananapi-bpi-r4-2g5.dtb` |
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Official BPI-R4 Page][7]
+- [BPI-R4 Forum][8]
+- [Frank-W's site][9]
+- [Release Downloads][10]
+- [Bootloader Builds][11]
+
+## Building Custom Images
+
+```bash
+# Build bootloaders for SD and eMMC
+make x-bpi-r4-sd-boot
+make x-bpi-r4-emmc-boot
+
+# Build main system
+make aarch64
+
+# Create SD card image
+./utils/mkimage.sh -od bananapi-bpi-r4
+
+# Create eMMC image
+./utils/mkimage.sh -odt emmc bananapi-bpi-r4
+```
+
+[0]: https://www.kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r4-sdcard.img
+[3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r4-emmc.img
+[4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r4-emmc-boot-2026.01-latest.tar.gz
+[7]: https://docs.banana-pi.org/en/BPI-R4/BananaPi_BPI-R4
+[8]: https://forum.banana-pi.org/
+[9]: https://wiki.fw-web.de/doku.php?id=en:bpi-r4:start
+[10]: https://github.com/kernelkit/infix/releases/tag/latest
+[11]: https://github.com/kernelkit/infix/releases/tag/latest-boot
+[12]: https://github.com/frank-w/u-boot/releases
+[13]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_bl2.img
+[14]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2026-01-bpi-2026.01-2026-01-15_2013/bpi-r4_spim-nand_fip.bin
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -0,0 +1,49 @@
+define BANANAPI_BPI_R4_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7988)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7988)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_MT6577)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_GPIO,y)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MTK_LVTS_THERMAL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_UART)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_WATCHDOG)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MEDIATEK_GE_SOC_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_MEDIATEK)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_MEDIATEK_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_NET_DSA_MT7530,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MT7996E,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_MEDIATEK_GEN3,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MTK_SCPSYS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_MTK)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_MT65XX,m)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XSPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XFI_TPHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PCS_STANDALONE,y)
+	$(call KCONFIG_SET_OPT,CONFIG_PCS_MTK_USXGMII,y)
+	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_PWM_FAN,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_MTK_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_MEDIATEK_2P5GE_PHY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_CRYPTO_DEV_SAFEXCEL,m)
+endef
+
+LINUX_DTS_MT7988 = $(LINUX_DIR)/arch/arm64/boot/dts/mediatek
+
+define BANANAPI_BPI_R4_KERNEL_DTBS_INSTALL_TARGET
+	@$(call MESSAGE,"Installing kernel DTBs and DTBOs for BPI-R4")
+	$(foreach f, \
+		mt7988a-bananapi-bpi-r4.dtb \
+		mt7988a-bananapi-bpi-r4-2g5.dtb \
+		mt7988a-bananapi-bpi-r4-sd.dtbo \
+		mt7988a-bananapi-bpi-r4-emmc.dtbo, \
+		$(INSTALL) -D $(LINUX_DTS_MT7988)/$(f) \
+			$(TARGET_DIR)/boot/mediatek/$(f)$(sep))
+endef
+BANANAPI_BPI_R4_POST_INSTALL_TARGET_HOOKS += BANANAPI_BPI_R4_KERNEL_DTBS_INSTALL_TARGET
+
+$(eval $(ix-board))
+$(eval $(generic-package))
@@ -0,0 +1,2 @@
+dtb-y += infix/bananapi,bpi-r4.dtbo
+dtb-y += infix/bananapi,bpi-r4-2g5.dtbo
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4-2g5";
+};
+
+/*
+ * On the 2g5 variant, GMAC1 uses the internal 2.5G PHY (eth1 renamed to
+ * "wan" by udev).  The switch's port0, which is labeled "wan" in the base
+ * DTS, would cause a name collision when the switch driver registers it.
+ * Rename it to "lan0" here so the kernel names it correctly from the start.
+ */
+&gsw_port0 {
+	label = "lan0";
+};
+
+/*
+ * The upstream mt7988a.dtsi sets compatible = "ethernet-phy-ieee802.3-c45"
+ * on the internal 2.5G PHY node.  That gives genphy_c45 (built-in) OF-match
+ * priority over the PHY-ID-based mtk-2p5ge driver, leaving the PHY powered
+ * down and unclaimed.  Replace it with the standard ethernet-phy-idXXXX.XXXX
+ * form so of_get_phy_id() registers the PHY as C22 with explicit ID 0x00339c11.
+ * mtk-2p5ge then matches via PHY_ID_MATCH_VENDOR(0x00339c00) instead of
+ * genphy_c45 winning via OF-match.
+ * Note: /delete-property/ is not used because U-Boot fdt apply does not
+ * implement property deletion in overlays.
+ */
+&int_2p5g_phy {
+	compatible = "ethernet-phy-id0033.9c11";
+};
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "bananapi,bpi-r4", "mediatek,mt7988a";
+};
+
+/*
+ * The upstream mt7988a-bananapi-bpi-r4.dtsi sets stdout-path = "serial0:..."
+ * but the aliases node there only has ethernet entries.  Linux resolves
+ * stdout-path by looking in /aliases, so we must add serial0 here.
+ * Path references in overlay aliases cannot use &label, so use the full path.
+ */
+&{/} {
+	aliases {
+		serial0 = "/soc/serial@11000000";
+	};
+
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			usb-ports = <&ssusb1>;
+			usb-port-names = "USB";
+		};
+	};
+};
@@ -0,0 +1,81 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-bpi-r4-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+                gpt-no-backup = true
+        }
+        # BL2 bootloader partition (MediaTek official location)
+	partition bl2 {
+		  image = "bl2.img"
+		  offset = 1024s   # 0x80000 = sector 1024
+		  size = 4M        # 0x400000
+		  bootable = true
+	}
+
+	# Factory/calibration data (sectors 9216-13311)
+	partition factory {
+		offset = 4608K  # 0x480000
+		size = 2M       # 0x200000
+	}
+
+	# FIP partition - BL31 + U-Boot (sectors 13312-17407)
+        partition fip {
+                image = "fip.bin"
+                offset = 13312s
+                size = 4096s
+        }
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                size = 250M
+                image = "rootfs.squashfs"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtbo /boot/infix/bananapi,bpi-r4.dtbo /boot/infix/bananapi,bpi-r4-2g5.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-sd.dtbo /boot/infix/bananapi,bpi-r4.dtbo /boot/infix/bananapi,bpi-r4-2g5.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-emmc.dtbo /boot/infix/bananapi,bpi-r4.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,5 @@
+label Infix (aarch64)
+	kernel /boot/Image
+	fdtdir /boot
+	fdtoverlays /boot/mediatek/mt7988a-bananapi-bpi-r4-sd.dtbo /boot/infix/bananapi,bpi-r4.dtbo
+	append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user}
@@ -0,0 +1,404 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan0",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R4"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,5 @@
+# The mtk-2p5ge PHY driver uses MDIO PHY ID matching, not OF compatible
+# matching.  udev auto-loading is based on MODALIAS, which for DT-described
+# devices is "of:N...C<compatible>" — a format that never matches the driver's
+# "mdio:..." module alias.  Match on OF_COMPATIBLE_0 explicitly instead.
+ACTION=="add", SUBSYSTEM=="mdio_bus", ENV{OF_COMPATIBLE_0}=="ethernet-phy-id0033.9c11", RUN+="/sbin/modprobe -b mtk-2p5ge"
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="wan"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth2", NAME="sfp1"
@@ -0,0 +1,396 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "broadcast"
+              },
+              {
+                "id": "domain"
+              },
+              {
+                "id": "hostname",
+                "value": "auto"
+              },
+              {
+                "id": "dns-server"
+              },
+              {
+                "id": "router"
+              },
+              {
+                "id": "netmask"
+              },
+              {
+                "id": "vendor-class",
+                "value": "Banana Pi BPI-R4"
+              }
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {
+                "id": "ntp-server"
+              },
+              {
+                "id": "client-fqdn"
+              },
+              {
+                "id": "domain-search"
+              },
+              {
+                "id": "dns-server"
+              }
+            ]
+          }
+        }
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-access",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-bind": [
+                  {
+                    "local-address": "::"
+                  }
+                ]
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+        "action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.7"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
@@ -0,0 +1,2 @@
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth1", NAME="sfp2"
+ACTION=="add", SUBSYSTEM=="net", DEVPATH=="/devices/platform/soc/15100000.ethernet/net/eth2", NAME="sfp1"
@@ -0,0 +1 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-emmc-env.dtsi"
@@ -0,0 +1,40 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_MULTI_DTB_FIT=y
+CONFIG_OF_LIST="mt7988a-bananapi-bpi-r4 mt7988a-bananapi-bpi-r4-2g5"
+
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_USB_MTU3=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_MTK_SPIM=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_SPI_FLASH=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTK_SPIM=y
+CONFIG_MTK_SNOR=y
+
+CONFIG_BUTTON=y
+CONFIG_BUTTON_CMD=y
+CONFIG_BUTTON_GPIO=y
+
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_DM=y
@@ -0,0 +1,7 @@
+#include <mt7988-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7988a-bananapi-bpi-r4.dtb";
+      board   = "bananapi,bpi-r4-emmc";
+      ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; setenv board bananapi,bpi-r4-2g5-emmc; fi";
+};
@@ -0,0 +1,27 @@
+/ {
+       config {
+               env: environment {
+                       bootcmd = "run ixboot";
+                       boot_targets = "mmc0";
+                       ethprime = "eth0";
+                       fdt_addr_r = "0x43f00000";
+                       kernel_addr_r = "0x44000000";
+                       fdtoverlay_addr_r = "0x47f00000";
+                       scriptaddr = "0x48000000";
+                       ramdisk_addr_r = "0x4A000000";
+
+                       /*
+                        * Apply BOARD_VARIANT from aux uboot.env.
+                        * Infix writes BOARD_VARIANT=2g5 via fw_setenv on
+                        * BPI-R4-2g5 / BPI-R4P boards to select the correct
+                        * device tree.  Unset = standard R4 (2x SFP+).
+                        */
+                       ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; fi";
+
+                       /* This is a development platform, keep
+                        * developer mode statically enabled.
+                        */
+                       ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+               };
+       };
+};
@@ -0,0 +1,7 @@
+#include <mt7988-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7988a-bananapi-bpi-r4.dtb";
+      board   = "bananapi,bpi-r4-sdmmc";
+      ixvariant = "if test \"${BOARD_VARIANT}\" = \"2g5\"; then setenv fdtfile mediatek/mt7988a-bananapi-bpi-r4-2g5.dtb; setenv board bananapi,bpi-r4-2g5-sdmmc; fi";
+};
@@ -0,0 +1,2 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-sd-env.dtsi"
+CONFIG_OF_LIST="mt7988a-bananapi-bpi-r4-sd"
@@ -14,7 +14,7 @@ The Banana Pi BPI-R64 is a networking board based on the MediaTek MT7622
 - 8 GB eMMC storage
 - microSD card slot
 - MT7531 Gigabit Ethernet switch (4x LAN + 1x WAN)
- MT7603E built-in 2.4 GHz WiFi
+- MT7622 WMAC built-in 2.4 GHz 802.11ac WiFi
 - USB 3.0 port
 - 2x Mini PCIe slots

@@ -24,26 +24,21 @@ Infix comes preconfigured with:

 - **LAN ports** (lan0-lan3): Bridged for internal networking
 - **WAN port**: DHCP client enabled for internet connectivity
- **WiFi** (wifi0-ap): Bridged to LAN (MT7615 PCIe card if fitted, otherwise MT7603E)
+- **WiFi** (wifi0-ap): Bridged to LAN (MT7622 WMAC, 2.4 GHz; or MT7615 PCIe card if fitted)

 ## Boot Switch Reference

 <img align="right" src="bpi-r64-sw1.png" alt="SW1 Boot Switch" width=90 padding=10>

-The BPI-R64 uses a 2-position DIP switch (SW1) to select the boot device
-order.  The MT7622 Boot ROM tries devices in the order listed and falls
-back to the next if no valid BL2 is found at the expected location.
+The BPI-R64 has a 2-position DIP switch (SW1) for selecting the boot device.
+The MT7622 Boot ROM always tries SD first if a card is present, so you can
+leave SW1 in the OFF (eMMC) position and simply insert or remove an SD card
+to control boot device selection.

-| SW1 | Boot device | Use case                   |
-|-----|-------------|----------------------------|
-| OFF | eMMC        | Production eMMC boot       |
-| ON  | SD card     | SD card boot / development |
-
-> [!NOTE]
-> SinoVoip has exposed only one bit of the MT7622's two-bit `BOOT_SEL[1:0]`
-> strapping field via SW1, with `BOOT_SEL[1]` hardwired high.  This limits the
-> board to eMMC (`10b`) and SD (`11b`) boot; the SPI-NOR and SPI-NAND modes
-> available on the MT7622 reference board (`00b`, `01b`) are not selectable.
+| SW1 | Boot device |
+|-----|-------------|
+| OFF | eMMC        |
+| ON  | SD card     |

 ## Getting Started

@@ -58,11 +53,10 @@ back to the next if no valid BL2 is found at the expected location.
   dd if=infix-*-bpi-r64-sdcard.img of=/dev/sdX bs=4M status=progress
   ```

-2. **Set boot switch:** SW1 ON (SD card boot)
-3. **Insert SD card and power on**
-4. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
+2. **Insert SD card and power on**
+3. **Connect console:** 115200 8N1 — use the dedicated Debug UART header
   just below the 40-pin GPIO header; pins are labeled GND, RX, TX on the board
-5. **Default login:** `admin` / `admin`
+4. **Default login:** `admin` / `admin`

 ## Installing to eMMC

@@ -84,9 +78,8 @@ drive.

 #### Step 1: Boot from SD card

-1. Set SW1 to ON (SD boot)
-2. Insert SD card with Infix
-3. Power on and break into U-Boot (press Ctrl-C during boot)
+1. Insert SD card with Infix
+2. Power on and break into U-Boot (press Ctrl-C during boot)

 #### Step 2: Write the eMMC image from U-Boot

@@ -115,12 +108,24 @@ mmc partconf 0 1 1 0
 #### Step 4: Boot from eMMC

 1. Power off the board
-2. Set SW1 to OFF (eMMC boot)
-3. Remove SD card and USB drive
-4. Power on
+2. Remove SD card and USB drive
+3. Power on

 ## Platform Notes

+### WiFi
+
+The MT7622 SoC includes a built-in WMAC that provides 2.4 GHz 802.11b/g/n/ac
+(2×2) — there is no 5 GHz capability from the onboard radio.
+
+For dual-band operation, a PCIe card can be fitted in one of the two Mini PCIe
+slots.  The [Banana Pi BPI-MT7615][bpi-mt7615] is a purpose-built dual-band
+(2.4 + 5 GHz, 802.11ac 4×4) module designed for BPI router boards and is a
+natural fit.  With it installed, Infix will use it in preference to the onboard
+WMAC for the `wifi0-ap` interface.
+
+[bpi-mt7615]: https://docs.banana-pi.org/en/BPI-MT7615/BananaPi_MT7615
+
 ### mmc0 = eMMC, mmc1 = SD

 On MT7622, MSDC0 (mmc0) is the 8-bit eMMC controller and MSDC1 (mmc1) is the
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -1,2 +1,3 @@
 CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-emmc-env.dtsi"
 CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_CMD_MMC_PARTCONF=y
@@ -1 +1,3 @@
 CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7622-sd-env.dtsi"
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_CMD_MMC_PARTCONF=y
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,232 @@
+# Marvell ESPRESSObin
+
+<img src="espressobin.png" alt="The board" width=800 padding=10>
+
+The [ESPRESSObin][0] is a single-board computer based on the [Marvell Armada
+3720][1] (dual Cortex-A53, AArch64) SoC and the [Marvell 88E6341][2] (Topaz)
+switch, oriented toward networking applications.
+
+The board design is old but the switch offers full Linux support, including
+advanced TSN features for [IEEE 1588-2019][3] (PTP) and [IEEE 802.1AS-2020][4]
+(gPTP).
+
+## Board Variants
+
+The board has gone through several hardware revisions:
+
+| Revision   | Storage             | Notes                          |
+|------------|---------------------|--------------------------------|
+| v1, v3, v5 | SPI NOR only        | Obsolete; U-Boot always in SPI |
+| v7         | SPI NOR + 4 GB eMMC | Current; SD and eMMC usable    |
+| Ultra      | SPI NOR + 4 GB eMMC | High-end variant               |
+
+On **all revisions** the Boot ROM is hardwired to load U-Boot from SPI NOR
+flash.  There is no strap or jumper to make the Boot ROM load directly from an
+SD card.  The SD card (or eMMC on v7/Ultra) is used only for the operating
+system.
+
+## Building
+
+The ESPRESSObin uses ext4 for its rootfs partitions rather than the default
+squashfs, because the stock SPI U-Boot lacks squashfs and `blkmap` support.
+The `ext4` configuration snippet enables this.  Apply it once after selecting
+the defconfig, then build and compose the SD card image:
+
+```sh
+make O=x-aarch64 aarch64_defconfig
+make O=x-aarch64 apply-ext4
+make O=x-aarch64
+
+utils/mkimage.sh -r x-aarch64 marvell-espressobin
+```
+
+The resulting image (`x-aarch64/images/infix-espressobin-sdcard.img`) contains
+a GPT disk with the standard Infix partition layout, using ext4 instead of the
+read-only squashfs:
+
+| Partition | Label     | Contents                     |
+|-----------|-----------|------------------------------|
+| 1         | aux       | RAUC upgrade state (ext4)    |
+| 2         | primary   | Rootfs slot primary (ext4)   |
+| 3         | secondary | Rootfs slot secondary (ext4) |
+| 4         | cfg       | Persistent config (ext4)     |
+| 5         | var       | Runtime data (ext4)          |
+
+## Writing to SD Card
+
+```sh
+dd if=infix-espressobin-sdcard.img of=/dev/sdX bs=4M status=progress conv=fsync
+```
+
+## Upgrading
+
+The build produces `x-aarch64/images/infix-aarch64-ext4.pkg`, a RAUC bundle
+containing the ext4 rootfs.  Once the board is running Infix, upgrade over the
+network in the usual way:
+
+```
+upgrade ftp://192.168.1.1/infix-aarch64-ext4.pkg
+```
+
+RAUC writes the new rootfs to the inactive slot, updates `BOOT_ORDER` in
+`/mnt/aux/uboot.env`, and the next boot picks it up automatically.
+
+> [!NOTE]
+> Use `infix-aarch64-ext4.pkg`, not the standard `infix-aarch64.pkg`.  The
+> standard bundle contains a squashfs rootfs which the stock U-Boot cannot
+> boot.
+
+## Booting with the Stock SPI U-Boot
+
+The stock Marvell U-Boot has `ext4load` and the standard variables
+(`$kernel_addr`, `$fdt_addr`, `$loadaddr`, `$console`, `$image_name`,
+`$fdt_name`) already set sensibly.  Connect to the board's console port, the
+micro USB connector, at 115200 8N1, interrupt autoboot, and paste the commands
+below.
+
+### Environment Variable Reference
+
+These variables are pre-set in the stock U-Boot environment.  Restore them
+with these values if they are ever lost or corrupted:
+
+```
+setenv kernel_addr  0x5000000
+setenv fdt_addr     0x4f00000
+setenv loadaddr     0x5000000
+setenv console      'console=ttyMV0,115200 earlycon=ar3700_uart,0xd0012000'
+setenv image_name   boot/Image
+setenv extra_params quiet
+```
+
+`$fdt_name` selects the device tree for your specific board revision:
+
+| Board revision | `fdt_name` value                                    |
+|----------------|-----------------------------------------------------|
+| v3 / v5        | `boot/marvell/armada-3720-espressobin.dtb`          |
+| v7             | `boot/marvell/armada-3720-espressobin-v7.dtb`       |
+| Ultra          | `boot/marvell/armada-3720-espressobin-ultra.dtb`    |
+| v3/v5 eMMC     | `boot/marvell/armada-3720-espressobin-emmc.dtb`     |
+| v7 eMMC        | `boot/marvell/armada-3720-espressobin-v7-emmc.dtb`  |
+
+```
+setenv fdt_name boot/marvell/armada-3720-espressobin.dtb   # adjust for your board
+```
+
+### Simple Boot
+
+Fixed boot from the primary slot, useful for initial bring-up:
+
+```
+setenv bootcmd 'mmc dev 0; \
+  ext4load mmc 0:2 $kernel_addr $image_name; \
+  ext4load mmc 0:2 $fdt_addr $fdt_name; \
+  setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+  booti $kernel_addr - $fdt_addr'
+saveenv
+```
+
+### Automatic Slot Selection (RAUC Integration)
+
+The CLI `upgrade` command writes to the inactive slot and updates `uboot.env`
+on the `aux` partition with the new boot order.  On the next boot U-Boot reads
+`BOOT_ORDER` from the aux partition and selects the appropriate slot.  The
+setup below also defines `bootcmd_primary`, `bootcmd_secondary`, and
+`bootcmd_net` for manual use (see [Manual Slot Selection](#manual-slot-selection)
+and [Netbooting](#netbooting)):
+
+```
+setenv bootcmd_boot \
+  'mmc dev 0; \
+   ext4load mmc 0:$bootpart $kernel_addr $image_name; \
+   ext4load mmc 0:$bootpart $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=$bootslot rw rootwait $extra_params rauc.slot=$bootslot; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd_primary   'setenv bootpart 2; setenv bootslot primary;   run bootcmd_boot'
+setenv bootcmd_secondary 'setenv bootpart 3; setenv bootslot secondary; run bootcmd_boot'
+
+setenv bootcmd_net \
+  'dhcp $kernel_addr $image_name; \
+   tftpboot $fdt_addr $fdt_name; \
+   setenv bootargs $console root=PARTLABEL=primary rw rootwait $extra_params rauc.slot=primary; \
+   booti $kernel_addr - $fdt_addr'
+
+setenv bootcmd \
+  'setenv bootpart 2; setenv bootslot primary; setenv auxpart 1; \
+   if ext4load mmc 0:$auxpart $loadaddr /uboot.env; then \
+     env import -c $loadaddr $filesize BOOT_ORDER; \
+   fi; \
+   if test "$BOOT_ORDER" = "secondary primary" || \
+      test "$BOOT_ORDER" = "secondary primary net"; then \
+     setenv bootpart 3; setenv bootslot secondary; \
+   fi; \
+   if test "$BOOT_ORDER" = "net" || \
+      test "$BOOT_ORDER" = "net primary" || \
+      test "$BOOT_ORDER" = "net secondary primary"; then \
+     run bootcmd_net; \
+   fi; \
+   echo ">> Booting $bootslot from mmc 0:$bootpart ..."; \
+   run bootcmd_boot'
+
+saveenv
+```
+
+### Manual Slot Selection
+
+To boot a specific slot without waiting for the autoboot countdown, interrupt
+the bootloader (press any key) and run one of the convenience commands defined
+above:
+
+```
+run bootcmd_primary      # boot from primary   (partition 2)
+run bootcmd_secondary    # boot from secondary (partition 3)
+run bootcmd_net          # netboot via DHCP/TFTP
+```
+
+You can also force a permanent change to which slot boots next by setting
+`BOOT_ORDER` directly from Linux (the change persists across reboots):
+
+```sh
+fw_setenv BOOT_ORDER "secondary primary"   # next boot: secondary
+fw_setenv BOOT_ORDER "primary secondary"   # next boot: primary  (default)
+```
+
+### Netbooting
+
+The stock U-Boot supports TFTP.  This is useful for testing a new kernel or
+device tree without reflashing the SD card.  Set up a TFTP server with the
+contents of the Infix `boot/` directory (from the built rootfs at
+`x-aarch64/target/boot/`) and configure the variables:
+
+```
+setenv serverip 192.168.1.1    # IP of your TFTP server
+setenv ipaddr   192.168.1.100  # board IP (omit if using dhcp)
+saveenv
+```
+
+Then netboot manually:
+
+```
+run bootcmd_net
+```
+
+`bootcmd_net` uses `dhcp` to obtain an IP address and the `$serverip` from
+the DHCP server (option 66), then downloads `$image_name` and `$fdt_name`
+via TFTP.  The kernel mounts the primary SD card slot as root, so the SD
+card must still be present.
+
+To make netbooting the default on next boot (e.g. for iterative kernel
+development), set `BOOT_ORDER` from Linux:
+
+```sh
+fw_setenv BOOT_ORDER "net primary secondary"
+```
+
+This causes `bootcmd` to attempt netboot first; on failure it falls through
+to the primary slot on the SD card.
+
+[0]: https://wiki.espressobin.net/
+[1]: https://www.marvell.com/content/dam/marvell/en/public-collateral/embedded-processors/marvell-embedded-processors-armada-37xx-hardware-specifications.pdf
+[2]: https://www.marvell.com/content/dam/marvell/en/public-collateral/switching/marvell-link-street-88E6341-product-brief.pdf
+[3]: https://standards.ieee.org/ieee/1588/6825/
+[4]: https://standards.ieee.org/ieee/802.1AS/7121/
@@ -1,25 +0,0 @@
-image cfg.ext4 {
-	ext4 {
-		label = "cfg"
-	}
-	empty = true
-	size = 16M
-}
-
-image sdcard.img {
-	hdimage {
-	}
-
-	partition rootfs {
-		partition-type = 0x83
-		image = "rootfs.ext4"
-	}
-
-	partition cfg {
-		partition-type = 0x83
-		image = "cfg.ext4"
-	}
-}
-
-# Silence genimage warnings
-config {}
@@ -0,0 +1,61 @@
+image cfg.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card.
+image var.ext4 {
+        empty = true
+        temporary = true
+        size = 128M
+        ext4 {
+                label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+        }
+}
+
+image #INFIX_ID##VERSION#-espressobin-#TARGET#.img {
+        hdimage {
+                partition-table-type = "gpt"
+        }
+
+        # No bootloader partition: U-Boot lives in SPI NOR flash on all
+        # ESPRESSObin board revisions.  The SD card carries the OS only.
+
+        partition aux {
+                partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+                image = "aux.ext4"
+        }
+
+        partition primary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition secondary {
+                partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+                bootable = true
+                image = "rootfs.ext2"
+        }
+
+        partition cfg {
+                partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+                image = "cfg.ext4"
+        }
+
+        partition var {
+                partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+                image = "var.ext4"
+        }
+}
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -2,29 +2,18 @@
 #include "infix.dtsi"

 / {
-	/* Dynamic GPU reservation */
-	gpu-reserved {
-		size = <0x0 0x10000000>; /* 256MB */
-		alignment = <0x0 0x1000000>; /* 16MB aligned */
-		alloc-ranges = <0x0 0x10000000 0x1 0x00000000>; /* Allow anywhere in RAM */
-		no-map;
-	};
-
-	/* CMA pool */
-	cma-reserved {
-		compatible = "shared-dma-pool";
-		size = <0x0 0x10000000>; /* 256MB */
-		alignment = <0x0 0x1000000>; /* 16MB aligned */
-		linux,cma-default;
-		reusable;
-	};
-
 	chosen {
 		/* 8250 auxiliary UART instead of pl011 */
 		stdout-path = "serial1:115200n8";
 	};
 };

+/* Override upstream 64MB CMA with 256MB for vc4 GPU */
+&rmem {
+	cma: linux,cma {
+		size = <0x10000000>; /* 256MB */
+	};
+};

 &vc4 {
 	status = "okay";
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  d48246c717b505cc11df95171f2fd548b389e1a463f1af4c68d0b69fe0d1009b  LICENSE
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256  dbe4eae8debbba8135297e15f24aeefef0b4c03781f3f9328db4398d58a728b3  LICENSE
@@ -5,6 +5,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-aux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-qcow/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-gns3a/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rauc/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-ext4-rauc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-dl-release/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"

@@ -0,0 +1,27 @@
+config IMAGE_EXT4_RAUC
+	bool "RAUC upgrade bundle (ext4)"
+	depends on BR2_TARGET_ROOTFS_EXT2
+	select BR2_PACKAGE_HOST_RAUC
+	help
+	  Create a RAUC upgrade bundle for targets using an ext4 rootfs
+	  image.  Intended for development boards whose bootloader does
+	  not support squashfs.
+
+config IMAGE_EXT4_RAUC_KEY
+	string "signing key"
+	depends on IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private key, in PKCS#8 format, used to sign
+	  the RAUC bundle; or a PKCS#11 URI.
+
+config IMAGE_EXT4_RAUC_CERT
+	string "signing certificate"
+	depends on IMAGE_EXT4_RAUC
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+	help
+	  Path to the X509 certificate which will be associated with
+	  the bundle signature.
+
+	  NOTE: This cert MUST be included in the trust store of the
+	        system on which this bundle is to be installed.
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+
+ext2="${BINARIES_DIR}/rootfs.ext2"
+pkg="${BINARIES_DIR}/${ARTIFACT}-ext4.pkg"
+
+# RAUC internally uses the file extension to find a suitable install
+# handler, hence the name must be .img
+cp -f "${ext2}" "${WORKDIR}/rootfs.img"
+
+cat >"${WORKDIR}/manifest.raucm" <<EOF
+[update]
+compatible=${COMPATIBLE}
+version=${VERSION}
+
+[bundle]
+format=verity
+
+[image.rootfs]
+filename=rootfs.img
+EOF
+
+rauc --cert="${CERT}" --key="${KEY}" \
+     bundle "${WORKDIR}" "${pkg}.next"
+
+mv "${pkg}.next" "${pkg}"
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-ext4-rauc
+#
+################################################################################
+
+IMAGE_EXT4_RAUC_DEPENDENCIES := host-rauc
+IMAGE_EXT4_RAUC_CONFIG_VARS := KEY CERT
+
+$(eval $(ix-image))
@@ -0,0 +1,3 @@
+service <!> name:phc2sys :%i log:prio:daemon,tag:phc2sys-%i \
+	[2345] phc2sys -a -z /var/run/ptp4l-%i \
+	-- PHC synchronization for PTP instance %i
@@ -0,0 +1,3 @@
+service <!> name:ptp4l :%i log:prio:daemon,tag:ptp4l-%i \
+	[2345] ptp4l -f /etc/linuxptp/ptp4l-%i.conf \
+	-- PTP instance %i
@@ -567,6 +567,59 @@ def probe_wifi_radios(out):
        out["wifi-radios"].append(info)


+def probe_ptp_capabilities(out):
+    """Probe PTP timestamping capabilities per physical interface via ethtool --json -T.
+
+    Only physical interfaces (those with a 'device' sysfs symlink) are probed;
+    virtual interfaces such as bridges, VLANs, and tun/tap devices are skipped.
+    Results are stored under out["interfaces"][<ifname>]["ptp-capabilities"].
+    """
+    net_base = "/sys/class/net"
+    if not os.path.exists(net_base):
+        return
+
+    ifaces = {}
+    for ifname in sorted(os.listdir(net_base)):
+        if ifname == "lo":
+            continue
+        # Physical interfaces have a 'device' symlink; virtual ones do not.
+        if not os.path.exists(os.path.join(net_base, ifname, "device")):
+            continue
+
+        try:
+            result = subprocess.run(
+                ["ethtool", "--json", "-T", ifname],
+                capture_output=True, text=True, timeout=5
+            )
+            if result.returncode != 0:
+                continue
+            data = json.loads(result.stdout)[0]
+        except Exception:
+            continue
+
+        caps = {
+            "capabilities": data.get("capabilities", []),
+            "tx-types":     data.get("tx-types", []),
+            "rx-filters":   data.get("rx-filters", []),
+        }
+
+        # phc-index is -1 when no PHC is present; omit in that case.
+        phc = data.get("phc-index", -1)
+        if phc >= 0:
+            caps["phc-index"] = phc
+
+        # hwtstamp provider fields are present only on newer kernels/hardware.
+        if (idx := data.get("hwtstamp-provider-index")) is not None:
+            caps["hwtstamp-provider-index"] = idx
+        if (qual := data.get("hwtstamp-provider-qualifier")) is not None:
+            caps["hwtstamp-provider-qualifier"] = qual
+
+        ifaces[ifname] = {"ptp-capabilities": caps}
+
+    if ifaces:
+        out.setdefault("interfaces", {}).update(ifaces)
+
+
 def main():
    out = {
        "vendor": None,
@@ -593,6 +646,7 @@ def main():
        return err

    probe_wifi_radios(out)
+    probe_ptp_capabilities(out)

    if not out["factory-password-hash"]:
        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
@@ -14,6 +14,7 @@
 	boot_targets = "virtio mmc";
 	bootcmd = "run ixboot";

+	ixvariant     = "";
 	ixpreboot     = /incbin/("scripts/ixpreboot.sh");
 	ixbtn-devmode = /incbin/("scripts/ixbtn-devmode.sh");
 	ixbtn-factory = /incbin/("scripts/ixbtn-factory.sh");
@@ -33,7 +33,8 @@ for tgt in "${boot_targets}"; do
 	setexpr ixmenu_n ${ixmenu_n} + 1

 	if load ${devtype} ${devnum}:${auxpart} ${loadaddr} /uboot.env; then
-	    env import -b ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact
+	    env import -c ${loadaddr} ${filesize} BOOT_ORDER DEBUG ethact BOARD_VARIANT
+	    run ixvariant
 	fi

 	if test -n "${DEBUG}"; then
@@ -6,4 +6,8 @@ $(DESTDIR)/boot/%.dtb: %.dtb
 	@echo "  DTB-INSTALL $<"
 	@install -D $< $@

+$(DESTDIR)/boot/%.dtbo: %.dtbo
+	@echo "  DTBO-INSTALL $<"
+	@install -D $< $@
+
 .PHONY: install
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -75,6 +75,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -134,6 +135,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
+BR2_PACKAGE_BANANAPI_BPI_R4=y
 BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
@@ -148,6 +150,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
 BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI=y
@@ -185,6 +188,7 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_PACKAGE_PCIUTILS=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -68,6 +68,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -113,6 +114,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
+BR2_PACKAGE_BANANAPI_BPI_R4=y
 BR2_PACKAGE_BANANAPI_BPI_R64=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_FRR=y
 BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -70,6 +70,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -0,0 +1,42 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="e06f258664198a901ff1c7c0c87802a115179451"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7988"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DRAM_USE_COMB=1 DDR4_4BG_MODE=1 BOARD_BGA=1 HAVE_DRAM_OBJ_FILE=yes USE_MKIMAGE=1 MKIMAGE=$(HOST_DIR)/bin/mkimage"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7988a_bpir4"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/emmc-extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/*.dtsi"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -0,0 +1,42 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+# BR2_PACKAGE_BUSYBOX is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_GIT=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_URL="https://github.com/mtk-openwrt/arm-trusted-firmware-mtk.git"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_REPO_VERSION="e06f258664198a901ff1c7c0c87802a115179451"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="mt7988"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_UBOOT_AS_BL33=y
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=sdmmc DRAM_USE_COMB=1 DDR4_4BG_MODE=1 BOARD_BGA=1 HAVE_DRAM_OBJ_FILE=yes USE_MKIMAGE=1 MKIMAGE=$(HOST_DIR)/bin/mkimage"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="*.img *.bin"
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mt7988a_bpir4_sd"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/sd-extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/bananapi-bpi-r4/uboot/*.dtsi"
+BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -85,6 +85,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -174,6 +175,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
@@ -206,6 +208,7 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_PACKAGE_PCIUTILS=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -20,6 +20,7 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5ekemmc_uboot"
 BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc"
@@ -20,6 +20,7 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5eksd_uboot"
 BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc1"
@@ -0,0 +1 @@
+BR2_TARGET_ENABLE_ROOT_LOGIN=y
@@ -0,0 +1,4 @@
+BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_4=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
+IMAGE_EXT4_RAUC=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -74,6 +74,7 @@ BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_MTR=y
@@ -146,6 +147,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_QUALCOMM=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
@@ -181,6 +183,7 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_PACKAGE_PCIUTILS=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.20"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.25"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -67,6 +67,7 @@ BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_LINUXPTP=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -3,7 +3,57 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.03.0][] - 2026-03-30
+[v26.04.0][] - 2026-04-30
+-------------------------
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.25 (LTS)
+- Upgrade Buildroot to 2025.02.13 (LTS)
+- Add support for per-bridge multicast router port in operational, issue #395
+- Add support for static ARP (IPv4) and neighbor cache (IPv6) entries per
+  interface, issue #819.  Static entries are installed as permanent kernel
+  neighbor table entries that are never evicted by normal ARP/NDP aging
+- Add support for PTP/gPTP (IEEE 1588-2019 / 802.1AS) clock synchronization.
+  Supported clock types: Ordinary Clock, Boundary Clock, and Transparent Clock.
+  See the User Guide for configuration details
+- Add support for [Banana Pi BPI-R4][BPI-R4], quad-core Cortex-A73 router with
+  4x 2.5 GbE switching, dual 10 GbE SFP+.  Variants BPI-R4-2g5 and BPI-R4P have
+  one SFP+ replaced by a 2.5 GbE RJ45, with optional PoE on the R4P
+- Update [Marvell ESPRESSObin][ESPRESSObin] board support.  Allow booting with
+  stock U-Boot, which only supports ext4 rootfs partitions; to use, apply the
+  `ext4` developer snippet before building (`make apply-ext4 all`)
+- Fix onboard WiFi support on the Banana Pi BPi-R64
+
+### Fixes
+
+- Fix #520: warn in syslog if multicast flooding is disabled
+- Fix #769: document dummy interfaces in user guide
+- Fix #790: document static multicast filters in user guide
+- Fix #1439: changing hostname does not regenerate DHCP client conf until restart
+- Fix #1458: `show ntp tracking` displaying a truncated Reference ID, e.g.,
+  `92.2` instead of `92.246.137.39`
+- Fix #1466: `show container` showing no output for containers whose command
+  line includes environment variables
+- Fix issue with IGMP queries sent with all-zeroes source MAC address
+- Fix missing IGMP query startup burst when assuming IGMP querier role, as
+  defined in RFC3376 §8.6/§8.7
+- Fix Raspberry Pi 4 and Pi 400 display instability after soft reboot.
+  Previously the touchscreen/DSI display required a full power cycle to
+  reinitialise correctly; it now works reliably after `reboot`.  Please note,
+  you need a fairly up-to-date EEPROM version as well
+- Fix [BPI-R4][] board README showing inverted DIP switch values for eMMC and
+  SPI NAND boot modes, which would prevent the board from booting correctly
+- Fix [SAMA7G54][] U-Boot build system selection that caused build failures
+- Fix [BPI-R3][] PCIe devices failing to initialize on boot due to a missing
+  clock definition in the device tree
+
+[BPI-R3]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3
+[BPI-R4]: https://docs.banana-pi.org/en/BPI-R4/BananaPi_BPI-R4
+[ESPRESSObin]: https://espressobin.net/
+[SAMA7G54]: https://www.microchip.com/en-us/development-tool/ev21h18a
+
+[v26.03.0][] - 2026-03-31
 -------------------------

 ### Changes
@@ -168,6 +218,12 @@ Noteworthy changes and additions in this release are marked below in bold text.
  latter now also require the use of `sudo` for `admin` level users
 - Enhanced `copy` command with XPath filtering support
 - Kernel now announces details of new USB devices
+- New `show keystore` admin-exec command to inspect stored keys and
+  certificates without entering configure context
+- `show system` now displays CPU/SoC temperature on all supported platforms,
+  including those that report it under the `soc` or `core` sensor name
+- CN913x (Marvell Octeon) platforms now use the hardware SBSA watchdog,
+  ensuring the device recovers automatically from software lockups

 ### Fixes

@@ -176,6 +232,8 @@ Noteworthy changes and additions in this release are marked below in bold text.
  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
 - Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
  Wi-Fi concept in Infix
+- Fix #1292: watchdog not working on NanoPi R2S due to a broken DesignWare
+  WDT on the RK3328 SoC; the hardware watchdog is now disabled on this board
 - Fix #1313: Container is not restarted if environment variable is changed
 - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
  newer EEPROM firmware in newer boards require a newer rpi-firmware package
@@ -185,8 +243,16 @@ Noteworthy changes and additions in this release are marked below in bold text.
  not include a dtb.  Please note, the platform has now been renamed to `arm`
 - Fix default password hash in `do password encrypt` command.  New hash is the
  same as the more commonly used `change password` command, *yescrypt*
+- Fix BPI-R3 hardware watchdog, wrong kernel config option used — the device
+  would not recover automatically from a software lockup
+- Fix WiFi signal strength display showing inverted quality labels (`excellent`
+  shown for weak signals, `bad` for strong)
+- Fix `follow` command (both shell and CLI) not properly handling log rotation;
+  it now shows the full log and tails it correctly across rotations
 - Prevent MOTD from showing on non-shell user login attempts
- Fix mDNS reflector.
+- Fix mDNS reflector never actually enabling — the avahi config was written
+  with `on`/`off` instead of the correct `yes`/`no` values, so enabling the
+  reflector in the configuration had no effect

 [wifi]: https://www.kernelkit.org/infix/latest/wifi/
 [sd card image]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-rpi64-sdcard.img
@@ -2009,7 +2075,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.02.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.03.0...HEAD
 [v26.03.0]:   https://github.com/kernelkit/infix/compare/v26.02.0...v26.03.0
 [v26.02.0]:   https://github.com/kernelkit/infix/compare/v26.01.0...v26.02.0
 [v26.01.0]:   https://github.com/kernelkit/infix/compare/v25.11.0...v26.01.0
@@ -183,6 +183,48 @@ In this setup we have a lot more going on.  Multiple multicast router
 ports have been detected, and behind the scenes someone has also added
 an IGMP/MLD fast-leave port.

+### Static Multicast Filters
+
+When IGMP/MLD snooping is in use, traffic for an unregistered group is
+flooded to all ports until a receiver joins.  For MAC multicast groups,
+or for groups where snooping cannot learn membership automatically, you
+can add static entries to the MDB that immediately restrict forwarding
+to a given set of ports.
+
+> [!NOTE]
+> Snooping must be enabled on the bridge (or per VLAN) before static
+> multicast filters can be configured.
+
+On a plain (non-VLAN) bridge, add a static IPv4 or MAC multicast filter
+like this:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface br0</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 224.1.1.1 ports e2</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 224.1.1.1 ports e3</b>
+admin@example:/config/interface/br0/> <b>set bridge multicast-filters multicast-filter 01:00:5e:01:01:01 ports e2</b>
+admin@example:/config/interface/br0/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+Each `ports` entry for the same group adds one port to the filter.
+Receivers on all other ports will not see traffic for that group.
+
+On a VLAN-filtering bridge the filter is scoped per VLAN:
+
+<pre class="cli"><code>admin@example:/config/interface/br1/> <b>set bridge vlans vlan 10 multicast-filters multicast-filter 224.2.2.2 ports e5</b>
+admin@example:/config/interface/br1/> <b>set bridge vlans vlan 10 multicast-filters multicast-filter 224.2.2.2 ports e6</b>
+</code></pre>
+
+To verify the MDB — both statically configured and dynamically learned
+entries — use:
+
+<pre class="cli"><code>admin@example:/> <b>show bridge mdb</b>
+<span class="header">BRIDGE   VID  GROUP                 PORTS                              </span>
+br0           224.1.1.1             e2, e3
+br0           01:00:5e:01:01:01     e2
+</code></pre>
+
 ### Terminology & Abbreviations

 - **IGMP**: Internet Group Membership Protocol, multicast subscription
@@ -7,12 +7,12 @@ account, which is created based on credentials found in the VPD area --
 for Qemu devices this is emulated using `qemu_fw_cfg`.

 For developers this can be quite frustrating to be blocked from logging
-in to debug the system.  So we recommend enabling the `root` account in
-the Buildroot `make menuconfig` system.
+in to debug the system.  The quickest way to enable root login is to
+apply the `dev` configuration snippet:

-    make menuconfig
-         -> System configuration
-            -> [*]Enable root login with password
+    make apply-dev
+
+See [Configuration Snippets](#configuration-snippets) for more details.

 > [!IMPORTANT]
 > Please see the [Contributing](#contributing) section, below, for
@@ -166,6 +166,36 @@ on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.


+### Configuration Snippets
+
+Infix ships a set of Kconfig fragments in `configs/snippets/` that can
+be merged into your active `.config` on demand.  This avoids polluting
+defconfigs with settings that are only useful during development.
+
+To see what snippets are available:
+
+    make list-snippets
+
+To apply a single snippet to the current output directory:
+
+    make apply-dev          # enable root login
+    make apply-ext4         # build an ext4 rootfs (needed for boards
+                            # whose bootloader lacks squashfs support,
+                            # e.g. Marvell ESPRESSObin)
+
+The `apply-*` targets require an existing `.config` (i.e. you must have
+already run a `make <board>_defconfig`).  The snippet is merged using
+Buildroot's `merge_config.sh`, so it behaves like `make menuconfig`:
+unrelated settings are preserved, conflicting ones are overridden.
+
+To apply **all** snippets at once and then build:
+
+    make dev
+
+This is the recommended one-shot command for setting up a development
+build from a freshly selected defconfig.
+
+
 ### YANG Model

 When making changes to the `confd` and `statd` services, you will often
@@ -138,6 +138,49 @@ admin@example:/config/interface/veth0a/> <b>set custom-phys-address chassis offs
 </code></pre>


+## Dummy Interface
+
+A dummy interface is a virtual interface that is always administratively
+and operationally UP, regardless of any physical link state.  It can
+hold IP addresses just like any other interface.
+
+The two most common uses are:
+
+- **Stable OSPF router-ID**: OSPF picks its router-ID from an interface
+  address.  If that interface goes down, adjacencies can flap.  Binding
+  the router-ID to a /32 address on a dummy avoids this.
+- **Stable management address**: A /32 on a dummy gives the device a
+  permanent identity on the network, reachable as long as at least one
+  uplink is up and the address is redistributed into the routing domain.
+
+> [!TIP]
+> WiFi interfaces also use dummies as placeholders when the radio
+> hardware is not detected at boot (e.g., a USB dongle that was
+> unplugged).  See [WiFi](wifi.md) for details.
+
+### Example: Stable OSPF Router-ID
+
+Create a dummy interface with a /32 address and use it as the OSPF
+router-ID so that the ID never changes when physical ports bounce:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface lo0</b>
+admin@example:/config/interface/lo0/> <b>set type dummy</b>
+admin@example:/config/interface/lo0/> <b>set ipv4 address 192.0.2.1 prefix-length 32</b>
+admin@example:/config/interface/lo0/> <b>leave</b>
+admin@example:/config/> <b>edit routing control-plane-protocol ospfv2 name default ospf</b>
+admin@example:/config/routing/…/ospf/> <b>set explicit-router-id 192.0.2.1</b>
+admin@example:/config/routing/…/ospf/> <b>leave</b>
+admin@example:/> <b>copy running-config startup-config</b>
+</code></pre>
+
+To also make the address reachable by other routers, redistribute
+connected routes (or add `lo0` as an OSPF interface):
+
+<pre class="cli"><code>admin@example:/config/routing/…/ospf/> <b>set redistribute connected</b>
+</code></pre>
+
+
 [^1]: A YANG deviation was previously used to make it possible to set
    `phys-address`, but this has been replaced with the more flexible
    `custom-phys-address`.
@@ -435,6 +435,66 @@ admin@example:/config/interface/eth0/> <b>leave</b>
 admin@example:/>
 </code></pre>

+## ARP and Neighbor Cache
+
+Static ARP entries (IPv4) and neighbor cache entries (IPv6) can be
+configured per interface.  The most common reasons to do so are:
+
+- **Security** — prevent ARP/NDP spoofing by locking critical hosts
+  (e.g., a default gateway) to their known MAC addresses
+- **Reliability** — ensure reachability of a host even when ARP/NDP
+  traffic is suppressed or filtered (e.g., across a strict firewall)
+
+Dynamic entries are learned automatically by the kernel using ARP and
+Neighbor Discovery Protocol (NDP), and are visible as read-only
+operational state alongside the static ones.
+
+### Static IPv4 ARP Entry
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface eth0 ipv4</b>
+admin@example:/config/interface/eth0/ipv4/> <b>set neighbor 192.168.1.100 link-layer-address 00:11:22:33:44:55</b>
+admin@example:/config/interface/eth0/ipv4/> <b>diff</b>
+interfaces {
+  interface eth0 {
+    ipv4 {
+      neighbor 192.168.1.100 {
+        link-layer-address 00:11:22:33:44:55;
+      }
+    }
+  }
+}
+admin@example:/config/interface/eth0/ipv4/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+### Static IPv6 Neighbor Entry
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit interface eth0 ipv6</b>
+admin@example:/config/interface/eth0/ipv6/> <b>set neighbor 2001:db8::100 link-layer-address 00:11:22:33:44:55</b>
+admin@example:/config/interface/eth0/ipv6/> <b>diff</b>
+interfaces {
+  interface eth0 {
+    ipv6 {
+      neighbor 2001:db8::100 {
+        link-layer-address 00:11:22:33:44:55;
+      }
+    }
+  }
+}
+admin@example:/config/interface/eth0/ipv6/> <b>leave</b>
+admin@example:/>
+</code></pre>
+
+The full neighbor table — including dynamically learned entries (origin:
+*dynamic*) — is available as operational state via NETCONF or RESTCONF.
+
+> [!NOTE]
+> Static neighbor entries take effect immediately on `leave` (commit).
+> They are installed as *permanent* entries in the kernel neighbor table,
+> which means they are never evicted by the normal ARP/NDP aging process.
+
 [1]: https://www.rfc-editor.org/rfc/rfc3442
 [2]: https://www.rfc-editor.org/rfc/rfc8344
 [3]: https://www.rfc-editor.org/rfc/rfc8981
@@ -0,0 +1,461 @@
+# PTP — Precision Time Protocol
+
+The Precision Time Protocol (PTP), defined in IEEE 1588-2019, synchronises
+clocks across a network to sub-microsecond accuracy.  Where NTP (Network Time
+Protocol) aims at millisecond accuracy over wide-area networks, PTP is
+designed for local-area networks and relies on hardware timestamping in the
+network interface to eliminate software-induced jitter.
+
+PTP works by exchanging timestamped messages between devices.  A *grandmaster
+clock* — elected by the **Best TimeTransmitter Clock Algorithm (BTCA)** based
+on priority, clock class, and accuracy — distributes time to the rest of the
+network.  Each synchronising device measures the one-way message delay to its
+time-transmitter and continuously adjusts its local clock to compensate.
+
+> [!NOTE]
+> The IEEE 1588g-2022 amendment to IEEE 1588-2019 introduced the terms
+> *timeTransmitter* and *timeReceiver* as replacements for the former
+> *master* and *slave* terminology, and *Best TimeTransmitter Clock
+> Algorithm (BTCA)* in place of *BMCA*.  This document uses the updated
+> terms throughout.  You may even see the short forms transmitter and
+> receiver here and in online documentation.
+
+## Clock roles
+
+Every device in a PTP network takes one of the following roles:
+
+| Role                       | Description                                                                                 |
+|----------------------------|---------------------------------------------------------------------------------------------|
+| **Grandmaster (GM)**       | Network-wide time source; elected by BTCA                                                   |
+| **Time-transmitter**       | Sends Sync messages downstream on a port                                                    |
+| **Time-receiver**          | Synchronises to a time-transmitter on a port                                                |
+| **Boundary Clock (BC)**    | Terminates PTP on each port; acts as time-receiver upstream and time-transmitter downstream |
+| **Transparent Clock (TC)** | Passes PTP messages while correcting the residence-time delay accumulated in the device     |
+
+An **Ordinary Clock (OC)** has a single PTP port and is either a
+time-transmitter (acting as a grandmaster candidate) or a time-receiver
+(a leaf node synchronising to the network).
+
+## PTP profiles
+
+A **PTP profile** (as defined in IEEE 1588-2019 §3.1) is a document that
+specifies a consistent set of required, permitted, and prohibited PTP
+options for a particular application domain — much like a dialect of the
+protocol.  Examples from the standards world include profiles for power
+utilities (IEC/IEEE C37.238), telecom (ITU-T G.8265.1), and
+Time-Sensitive Networks.
+
+Each profile sets a unique value in the `majorSdoId` field of PTP message
+headers — a 4-bit identifier that lets devices distinguish traffic belonging
+to different profiles on the same link.  Profile also determines the network
+transport (UDP or Ethernet) and the delay measurement mechanism.
+
+Currently, two profiles are supported via the `profile` leaf in `default-ds`:
+
+| `profile`            | Standard          | majorSdoId | Transport | Delay          |
+|----------------------|-------------------|:----------:|-----------|----------------|
+| `ieee1588` (default) | IEEE 1588-2019    | `0x0`      | UDP/IPv4  | `e2e` or `p2p` |
+| `ieee802-dot1as`     | IEEE 802.1AS-2020 | `0x1`      | L2        | `p2p`          |
+
+The **gPTP** (generalized Precision Time Protocol) profile from IEEE 802.1AS-2020
+is used in **TSN** (Time-Sensitive Networking) and **AVB** (Audio/Video Bridging)
+applications.  Setting `profile ieee802-dot1as` applies all protocol-mandatory
+settings automatically — Layer 2 transport, P2P delay measurement, 802.1AS
+multicast addressing, path trace, follow-up information, and neighbour propagation
+delay thresholds.  The user still configures `priority1`, `priority2`,
+`domain-number`, `time-receiver-only`, and timer interval leaves.
+
+The `ieee1588` profile leaves transport and delay mechanism user-configurable
+per port.
+
+## Delay mechanisms
+
+PTP measures the link delay between neighbours using one of two mechanisms:
+
+- **End-to-End (E2E)**: Each time-receiver measures the delay to the
+  grandmaster by sending a `DELAY_REQ` message upstream.  Simple to
+  configure; works with any network topology.
+- **Peer-to-Peer (P2P)**: Each port measures its delay to its *immediate
+  neighbour* independently using `PDELAY_REQ` messages.  Enables faster
+  path-delay updates and is required by the gPTP profile.
+
+## Data Sets
+
+IEEE 1588 organises protocol state into named **Data Sets (DS)** — each a
+collection of related attributes for one aspect of a PTP instance.  You
+will encounter these directly in the CLI and in the `show ptp` output:
+
+| Data Set         | CLI node       | Contents                                                 |
+|------------------|----------------|----------------------------------------------------------|
+| Default DS       | `default-ds`   | Instance identity, clock class, priority, domain number  |
+| Current DS       | `current-ds`   | Live offset-from-GM, mean path delay, steps-removed      |
+| Parent DS        | `parent-ds`    | Grandmaster identity and quality attributes              |
+| Time Properties DS | `time-properties-ds` | UTC offset, leap-second flags, time source       |
+| Port DS          | `port-ds`      | Per-port state, delay mechanism, message intervals       |
+
+## Domains
+
+A **PTP domain** (0–255) is a logical partition of the network.  Devices
+only synchronise with others in the same domain.  Running multiple
+instances on the same device — one per domain, or one per profile — is
+fully supported; each instance is independent.
+
+Each PTP instance is identified on the network by its
+`(domain-number, profile)` pair, which must be unique across all instances
+on a device.
+
+> [!NOTE]
+> The `show ptp` offset values reflect **PHC** (PTP Hardware Clock)
+> synchronisation only.  A PHC is the hardware clock exposed by the network
+> interface; it tracks the PTP grandmaster but is independent of the Linux
+> system clock, which currently is **not** automatically adjusted.
+
+## Ordinary Clock (time-receiver)
+
+A typical time-receiver Ordinary Clock, synchronising on interface
+`eth0` using the default IEEE 1588 profile:
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds time-receiver-only true</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>leave</b>
+</code></pre>
+
+## Ordinary Clock (time-transmitter / grandmaster)
+
+A grandmaster clock with high priority, domain 0:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds priority1 1</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds priority2 1</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>leave</b>
+</code></pre>
+
+Lower `priority1` values win in the BTCA.  A clock with `priority1 1` will
+be preferred over the default `128` in any compliant network.
+
+## Boundary Clock
+
+A Boundary Clock terminates PTP on each port and re-originates it.  Add one
+port per interface:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds instance-type bc</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>end</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 2</b>
+admin@example:/config/ptp/…/0/port/2/> <b>set underlying-interface eth1</b>
+admin@example:/config/ptp/…/0/port/2/> <b>leave</b>
+</code></pre>
+
+> [!TIP]
+> PTP port numbers are assigned sorted by `port-index`, so `port-index 1`
+> becomes PTP port 1, `port-index 2` becomes PTP port 2, and so on.
+
+## Transparent Clock
+
+Transparent Clocks correct timestamps end-to-end without terminating PTP.
+Use `instance-type p2p-tc` for a P2P TC (preferred in TSN networks) or
+`instance-type e2e-tc` for an E2E TC:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds instance-type p2p-tc</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>end</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 2</b>
+admin@example:/config/ptp/…/0/port/2/> <b>set underlying-interface eth1</b>
+admin@example:/config/ptp/…/0/port/2/> <b>leave</b>
+</code></pre>
+
+> [!NOTE]
+> For Transparent Clocks the delay mechanism is determined globally by the
+> `instance-type` (`p2p-tc` → P2P, `e2e-tc` → E2E).  Per-port
+> `delay-mechanism` settings have no effect for TC instances.
+
+## gPTP / IEEE 802.1AS
+
+The gPTP profile is used in TSN and AVB applications.  Setting
+`profile ieee802-dot1as` applies all protocol-mandatory options from
+IEEE 802.1AS-2020 automatically — Layer 2 transport, P2P delay
+measurement, 802.1AS multicast addressing, and related protocol features.
+
+<pre class="cli"><code>admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds profile ieee802-dot1as</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds time-receiver-only true</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>leave</b>
+</code></pre>
+
+> [!NOTE]
+> The `ieee802-dot1as` profile enforces Layer 2 transport and P2P delay
+> measurement globally, as required by IEEE 802.1AS-2020.  Per-port
+> `delay-mechanism` settings have no effect for 802.1AS instances.
+
+## Multiple Instances
+
+Multiple PTP instances can run simultaneously, one per domain or profile
+combination.  Each instance must have a unique `(domain-number, profile)`
+pair and an independent set of ports:
+
+<pre class="cli"><code>admin@example:/config/> <b>edit ptp instance 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/0/> <b>set default-ds profile ieee1588</b>
+admin@example:/config/ptp/instance/0/> <b>edit port 1</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set underlying-interface eth0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>end</b>
+admin@example:/config/ptp/instance/0/> <b>end</b>
+admin@example:/config/ptp/> <b>edit instance 1</b>
+admin@example:/config/ptp/instance/1/> <b>set default-ds domain-number 0</b>
+admin@example:/config/ptp/instance/1/> <b>set default-ds profile ieee802-dot1as</b>
+admin@example:/config/ptp/instance/1/> <b>edit port 1</b>
+admin@example:/config/ptp/…/1/port/1/> <b>set underlying-interface eth1</b>
+admin@example:/config/ptp/…/1/port/1/> <b>leave</b>
+</code></pre>
+
+## Port states
+
+Each PTP port progresses through a state machine.  The current state is
+shown in the `show ptp` port table:
+
+| State                  | Meaning                                                        |
+|------------------------|----------------------------------------------------------------|
+| `initializing`         | Port is starting up, not yet ready to exchange messages        |
+| `faulty`               | A fault condition has been detected on this port               |
+| `disabled`             | Port is administratively disabled                              |
+| `listening`            | Awaiting `ANNOUNCE` messages; BTCA has not yet resolved        |
+| `pre-time-transmitter` | Transitioning towards time-transmitter state                   |
+| `time-transmitter`     | Port is acting as time-transmitter on this link                |
+| `passive`              | Another port on this device is already time-transmitter        |
+| `uncalibrated`         | Receiving sync; local clock not yet locked to time-transmitter |
+| `time-receiver`        | Port is locked and tracking its time-transmitter               |
+
+A port in `uncalibrated` will typically transition to `time-receiver`
+within a few seconds once the clock servo has converged.
+
+## Monitoring
+
+> [!TIP] Use the ++question++ key in the CLI
+> The `show ptp` command has sub-commands — tap ++question++ after
+> `show ptp` to see them, or use ++tab++ to complete.
+
+### Show all PTP instances
+
+<pre class="cli"><code>admin@example:/> <b>show ptp</b>
+<b>PTP Instance 0</b>                          Ordinary Clock · domain 0
+────────────────────────────────────────────────────────────────────
+  Clock identity          : AA-BB-CC-FF-FE-00-11-22
+  Grandmaster             : DD-EE-FF-FF-FE-33-44-55
+  Priority1/Priority2     : 128 / 128
+  GM Priority1/Priority2  : 1 / 1
+  Clock class             : cc-time-receiver-only
+  GM clock class          : cc-primary-sync
+  Time source             : gnss
+  PTP timescale           : yes
+  UTC offset              : 37 s
+  Time traceable          : yes
+  Freq. traceable         : yes
+  Offset from GM          : -42 ns
+  Mean path delay         : 1250 ns
+  Steps removed           : 1
+
+────────────────────────────────────────────────────────────────────
+Ports
+<span class="header">PORT  INTERFACE          STATE                DELAY  LINK DELAY (ns)</span>
+   1  eth0               <span class="ok">time-receiver</span>        E2E                  0
+
+────────────────────────────────────────────────────────────────────
+Message Statistics  (▼ rx  ▲ tx)
+<span class="header">PORT  INTERFACE             SYNC ▼  SYNC ▲  ANN ▼  ANN ▲  PD ▼  PD ▲</span>
+   1  eth0                      42       0     15      0     0     0
+
+</code></pre>
+
+Port state is colour-coded: green for `time-transmitter` and `time-receiver`
+(actively synchronising), yellow for transient states (`listening`,
+`uncalibrated`, `pre-time-transmitter`), and red for fault states (`faulty`,
+`disabled`).  The *Message Statistics* section is omitted when no counts are
+available.
+
+### Show a specific instance
+
+<pre class="cli"><code>admin@example:/> <b>show ptp 0</b>
+</code></pre>
+
+## Tuning port intervals
+
+Adjust announcement, sync, and delay-request intervals per port.  Values
+are expressed as log₂ of the interval in seconds (e.g. `-3` = 125 ms,
+`0` = 1 s, `1` = 2 s):
+
+<pre class="cli"><code>admin@example:/config/ptp/…/0/port/1/> <b>set port-ds log-announce-interval 0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set port-ds log-sync-interval -3</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set port-ds log-min-delay-req-interval 0</b>
+admin@example:/config/ptp/…/0/port/1/> <b>set announce-receipt-timeout 3</b>
+</code></pre>
+
+`announce-receipt-timeout` is a count of announce intervals, not a duration
+in seconds.  With `log-announce-interval 0` (1 s) and
+`announce-receipt-timeout 3`, a port waits 3 s without receiving an
+`ANNOUNCE` before declaring the time-transmitter lost and returning to
+`listening`.
+
+## Message exchange
+
+PTP distributes time using a small set of messages, all of which carry
+hardware timestamps at the network interface:
+
+| Message                 | Timestamped | Purpose                                             |
+|-------------------------|:-----------:|-----------------------------------------------------|
+| `ANNOUNCE`              | No          | Advertises clock quality for BTCA election          |
+| `SYNC`                  | Yes         | Carries transmitter timestamp to receivers          |
+| `FOLLOW_UP`             | No          | Carries precise `t1` in two-step mode               |
+| `DELAY_REQ`             | Yes         | Receiver-initiated E2E delay measurement            |
+| `DELAY_RESP`            | No          | Time-transmitter reply to `DELAY_REQ`               |
+| `PDELAY_REQ`            | Yes         | Initiates P2P neighbour-delay measurement           |
+| `PDELAY_RESP`           | Yes         | Neighbour reply to `PDELAY_REQ`                     |
+| `PDELAY_RESP_FOLLOW_UP` | No          | Carries precise `PDELAY_RESP` `t3` in two-step mode |
+
+In **one-step** mode the timestamp is embedded directly into each `SYNC`
+message as it leaves the wire, eliminating the need for `FOLLOW_UP`.
+In **two-step** mode the `SYNC` carries a placeholder and the precise
+transmit timestamp arrives in a subsequent `FOLLOW_UP`.  Hardware
+timestamping gives high accuracy in both modes; one-step reduces message
+overhead at the cost of more demanding hardware support.
+
+## Message format
+
+Every PTP message begins with a common 34-octet header, regardless of type.
+The structure below follows the traditional IETF bit-field layout: each row
+is four octets wide, bit 7 (MSB) is on the left and bit 0 (LSB) on the
+right within each octet.
+
+```
+         7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+  0-3   |trSpec |msgType|  rsv  |  ver  |         messageLength         |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+  4-7   |  domainNumber |  minorSdoId   |             flags             |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ 8-15   |                                                               |
+        +                        correctionField                        +
+        |                                                               |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+16-19   |                      messageTypeSpecific                      |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+20-27   |                                                               |
+        +                         clockIdentity                         +
+        |                                                               |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+28-31   |          portNumber           |           sequenceId          |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+32-33   |  controlField | logMsgIntvl   |
+        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+```
+
+- **`trSpec`** (`transportSpecific`, bits 7–4 of octet 0): 4-bit profile
+  identifier.  `0x0` = IEEE 1588, `0x1` = gPTP (802.1AS).  Set implicitly
+  by the `profile` configuration leaf.
+- **`msgType`** (`messageType`, bits 3–0 of octet 0): `0x0` SYNC ·
+  `0x1` DELAY_REQ · `0x2` PDELAY_REQ · `0x3` PDELAY_RESP ·
+  `0x8` FOLLOW_UP · `0x9` DELAY_RESP · `0xA` PDELAY_RESP_FOLLOW_UP ·
+  `0xB` ANNOUNCE.
+- **`rsv`** (reserved, bits 7–4 of octet 1): Set to zero; ignored on
+  receipt.
+- **`ver`** (`versionPTP`, bits 3–0 of octet 1): PTP version; `2` for
+  IEEE 1588-2008 and IEEE 1588-2019.
+- **`messageLength`** (octets 2–3): Total message length in octets,
+  including the header.
+- **`domainNumber`** (octet 4): PTP domain; receivers silently discard
+  messages that do not match their configured domain.
+- **`minorSdoId`** (octet 5): Reserved in IEEE 1588-2008; carries a
+  profile sub-identifier in IEEE 1588-2019.
+- **`flags`** (octets 6–7): Per-message flags — includes the two-step
+  flag (set when a FOLLOW_UP will follow a SYNC), UTC offset valid, and
+  leap-second indicators.
+- **`correctionField`** (octets 8–15): Accumulated path correction in
+  nanoseconds × 2¹⁶.  Transparent Clocks add their measured residence
+  time and link delay here as they forward each message, so the final
+  time-receiver can subtract the total accumulated delay.
+- **`messageTypeSpecific`** (octets 16–19): Reserved in IEEE 1588-2008;
+  carries message-type-specific data in IEEE 1588-2019.
+- **`clockIdentity`** (octets 20–27): EUI-64 identity of the sending
+  clock — the value shown as "Clock identity" in `show ptp`.
+- **`portNumber`** (octets 28–29): Port number of the sender within its
+  clock; together with `clockIdentity` it forms the unique
+  `sourcePortIdentity`.
+- **`sequenceId`** (octets 30–31): Increments with each message; used to
+  match a DELAY_REQ to its DELAY_RESP.
+- **`controlField`** (octet 32): Deprecated in PTPv2; set to fixed
+  values per message type for backward compatibility with PTPv1.
+- **`logMsgIntvl`** (`logMessageInterval`, octet 33): Log₂ of the
+  expected interval between messages of this type; `0x7F` means not
+  applicable.
+
+The `transportSpecific` and `domainNumber` fields are the quickest way to
+verify on the wire that a device is using the profile and domain you
+configured.
+
+### Decoding with Wireshark
+
+Wireshark decodes PTP messages automatically, expanding every header field
+and message-type-specific payload in the packet tree.  PTP travels over
+two UDP ports — 319 for event messages (SYNC, DELAY_REQ, PDELAY_REQ and
+their responses) and 320 for general messages (ANNOUNCE, FOLLOW_UP) — as
+well as directly over Ethernet (EtherType `0x88F7`) when layer-2 transport
+is in use.
+
+Use the display filter `ptp` to isolate PTP traffic:
+
+```
+ptp
+```
+
+To narrow down to a specific domain or profile (exact field names can be
+verified in Wireshark via **View → Internals → Supported Protocols**,
+filtering for `ptp`):
+
+```
+ptp.v2.domainnumber == 0
+ptp.v2.transportspecific == 1
+```
+
+This makes it straightforward to confirm which grandmaster a port is
+tracking, verify that `correctionField` is being updated by a Transparent
+Clock, or diagnose why the BTCA is not electing the expected grandmaster.
+
+## Glossary
+
+| Abbreviation | Expansion                            | Notes                                                             |
+|--------------|--------------------------------------|-------------------------------------------------------------------|
+| AVB          | Audio/Video Bridging                 | IEEE 802.1 precursor to TSN; real-time AV over Ethernet           |
+| IETF         | Internet Engineering Task Force      | Standards body; defines RFC for layer-3 and up                    |
+| UDP          | User Datagram Protocol               | IP transport used by PTP; port 319 (event) and 320 (general)      |
+| EUI-64       | Extended Unique Identifier (64-bit)  | IEEE identifier format used as `clockIdentity` in PTP             |
+| EtherType    | Ethernet frame type field            | `0x88F7` identifies PTP over layer-2 Ethernet                     |
+| BC           | Boundary Clock                       | Terminates and re-originates PTP on each port                     |
+| BTCA         | Best TimeTransmitter Clock Algorithm | Elects the GM; replaces BMCA from IEEE 1588-2008                  |
+| CMLDS        | Common Mean Link Delay Service       | IEEE 1588-2019 §16.6; shared delay service for multiple instances |
+| DS           | Data Set                             | Named attribute collection in IEEE 1588 (default-ds, port-ds, …)  |
+| E2E          | End-to-End                           | Delay mechanism: measures path from GM to time-receiver           |
+| GM           | Grandmaster                          | PTP network-wide time source, elected by BTCA                     |
+| gPTP         | generalized Precision Time Protocol  | IEEE 802.1AS profile; used in TSN and AVB                         |
+| NTP          | Network Time Protocol                | Millisecond-accuracy time protocol for wide-area use              |
+| OC           | Ordinary Clock                       | Single-port PTP clock; time-transmitter or time-receiver          |
+| P2P          | Peer-to-Peer                         | Delay mechanism: measures delay to immediate neighbour            |
+| PHC          | PTP Hardware Clock                   | Hardware clock in the NIC used for PTP timestamping               |
+| PTP          | Precision Time Protocol              | IEEE 1588 sub-microsecond clock synchronisation protocol          |
+| SDO          | Standards Development Organization   | Body that defines a PTP profile; encoded in `sdo-id`              |
+| TC           | Transparent Clock                    | Forwards PTP messages, correcting for residence-time delay        |
+| TSN          | Time-Sensitive Networking            | IEEE 802.1 standard set for deterministic Ethernet                |
@@ -359,6 +359,53 @@ $ make test-spec
 ...
 ```

+### Node and Link Capabilities
+
+Logical topology files (`topology.dot`) declare what each node and link
+*requires*; physical topology files declare what each node and link
+*provides*.  When mapping a logical topology to physical hardware, infamy
+only assigns a physical node to a logical node when the physical node's
+`provides` set is a superset of the logical node's `requires` set.  Tests
+are skipped if no matching physical topology can be found.
+
+#### Declaring requirements (logical topology)
+
+```dot
+dut [
+    requires="infix",
+];
+
+host:data -- dut:data [requires="ptp-hwts"]
+```
+
+#### Declaring capabilities (physical topology)
+
+```dot
+switch1 [
+    provides="infix",
+];
+
+switch1:eth0 -- switch2:eth0 [provides="ptp-hwts"]
+```
+
+#### Node capabilities
+
+| Capability        | Meaning                                                                 |
+|-------------------|-------------------------------------------------------------------------|
+| `controller`      | Reserved for the host/controller node; never assigned to a DUT          |
+| `infix`           | Node runs Infix OS — required by virtually all DUT nodes                |
+| `gps`             | Node has a GPS receiver available as a time reference                   |
+| `watchdog`        | Node has a hardware watchdog device                                     |
+
+#### Link capabilities
+
+| Capability        | Meaning                                                                 |
+|-------------------|-------------------------------------------------------------------------|
+| `mgmt`            | Link is a management path (typically coloured grey in diagrams)         |
+| `ieee-mc`         | Link carries IEEE multicast traffic (required by LAG and some L2 tests) |
+| `link-ctrl copper`| Link supports copper speed/duplex control                               |
+| `ptp-hwts`        | Both ends of this link support PTP hardware timestamping (PHC); required for sub-microsecond accuracy |
+
 ### Test Development

 For adding a new test to the automated regression test suite, it's best
@@ -47,6 +47,7 @@ nav:
      - Device Discovery: discovery.md
      - DHCP Server: dhcp.md
      - NTP Server: ntp.md
+      - PTP (IEEE 1588/802.1AS): ptp.md
  - System:
      - Boot Procedure: boot.md
      - Configuration: system.md
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Joachim WibergandGitHub	9406fd0e04	Merge pull request #1487 from kernelkit/releng	2026-04-30 18:53:48 +02:00
Joachim Wiberg	52ef3e2ded	.github: set INFIX_RELEASE when running release tests Without INFIX_RELEASE, make test resolves INFIX_ARTIFACT to the unversioned infix-x86_64, but release builds produce versioned artifacts (infix-x86_64-v26.04.0-rc1.qcow2 etc.), causing the test environment to fail with "No such file or directory". [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 18:34:35 +02:00
Joachim WibergandGitHub	3d1d73543e	Merge pull request #1486 from kernelkit/release-tests Run regression tests as part of release workflow	2026-04-30 16:08:51 +02:00
Tobias WaldekranzandGitHub	4c0996b52b	Merge pull request #1483 from saba8814/fix/uboot-aux-env-first-var-import fix: import first variable from auxiliary environment	2026-04-30 14:45:44 +02:00
Joachim Wiberg	e49682645c	.github: run regression tests as part of release workflow Add an x86_64 regression test job to release.yml that runs after the build and gates publishing — the release job now requires both build and test to succeed. Update test.yml's artifact restore step to use a glob so it handles both the unversioned CI artifact name (infix-x86_64.tar.gz) and the versioned release artifact name (infix-x86_64-26.04.0.tar.gz). Fixes #1392 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 13:45:35 +02:00
Joachim WibergandGitHub	a3c6ec0cd5	Merge pull request #1484 from kernelkit/releng Release preparations	2026-04-30 13:14:04 +02:00
Joachim Wiberg	25fcfba0cb	doc: update ChangeLog for v26.04.0 release [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:08:02 +02:00
Joachim Wiberg	5defdfdeac	doc: add section on dummy interfaces Fixes #769 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:08:02 +02:00
Joachim Wiberg	624bfd927c	doc: add section on static mutlicast filters Fixes #790 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:08:01 +02:00
Joachim Wiberg	4d8b2e5370	confd: warn if multicast flooding is disabled Fixes #520 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:08:01 +02:00
Joachim Wiberg	6aed1f7df4	confd: add support for static ARP and neighbor cache Add support for static ARP (IPv4) and neighbor cache (IPv6) entries per interface. Static entries are installed as permanent kernel neighbor table entries that are never evicted by normal ARP/NDP aging. Fixes #819 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:08:00 +02:00
Joachim Wiberg	7dd746d586	Fix BPi-R64 onboard WiFi probing The mt7622 soc has a built-in wmac, same driver as the mt7615, but it lacked MODULE_DEVICE_TABLE() so udev could not autoload driver and firmware. This commit also adds the wmac+bluetooth specific firmware. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:07:31 +02:00
Joachim Wiberg	b1ad0f1656	package/mcd: bump and add support for per-bridge mcast router ports Fixes #395 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-30 11:02:56 +02:00
Ejub Sabic	29222e18e9	uboot: import first variable from auxiliary environment The U-Boot env file is generated by mkenvimage, which prefixes the variable data with a 4-byte CRC32 by default. ixpreboot.sh previously imported it with `env import -b` as per uboot docs(-b assume binary format (’0’ separated, “00” terminated).), which treats the buffer as raw binary and does not strip the CRC. As a result the first variable's name is parsed a part of CRC. Later variables import correctly because by then the parser is past the CRC. Switching to `env import -c` as per uboot docs (-c assume checksum protected environment format.) makes U-Boot validate and strip the CRC before parsing, so the first variable imports under its real name. Tested on: - QEMU Signed-off-by: Ejub Sabic <ejub1946@outlook.com>	2026-04-29 23:27:37 +02:00
Joachim Wiberg	f9ea5567c4	package/finit: bump to v4.17 https://github.com/finit-project/finit/releases/tag/4.17 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-29 17:33:14 +02:00
Joachim WibergandGitHub	413d8e4599	Merge pull request #1485 from kernelkit/bpi-r3-pcifixes Bpi r3 pcifixes	2026-04-29 17:22:23 +02:00
Mattias Walström	507bb38bdc	feature-wifi: Enable 802.11 mesh (802.11s)	2026-04-29 15:47:30 +02:00
Mattias Walström	5cb17d69d4	bpi-r3: Enable the PCI clock in device tree	2026-04-29 15:43:24 +02:00
Joachim WibergandGitHub	6c6dc7711e	Merge pull request #1480 from saba8814/test/dhcp-client-hostname-not-resent test & fix: add DHCPv4 client hostname resend regression test, fix hostname resend	2026-04-28 19:46:47 +02:00
Ejub Sabic	4f2683090e	doc: updated documentation for issue #1439 Signed-off-by: Ejub Sabic <ejub1946@outlook.com>	2026-04-28 18:06:49 +02:00
Ejub Sabic	08ca47fdab	fix: dhcp client host name resend Signed-off-by: Ejub Sabic <ejub1946@outlook.com>	2026-04-28 18:00:32 +02:00
Ejub Sabic	17965bf4cc	test: add DHCPv4 client hostname resend regression test Signed-off-by: Ejub Sabic <ejub1946@outlook.com>	2026-04-28 18:00:28 +02:00
Joachim WibergandGitHub	82ffb0f4bc	Merge pull request #1481 from kernelkit/kernel-upgrade-28e7d3e7-b875-4444-a0ed-a6c18cefd76d Upgrade to kernel 6.18.25	2026-04-28 12:39:25 +02:00
Joachim WibergandGitHub	2788eb6d1a	Merge pull request #1482 from kernelkit/random-infamy-id-in-ci test: avoid infamy0 race in CI by using random container names	2026-04-28 11:43:58 +02:00
Richard Alpe	ba05c2e56d	test: avoid infamy0 race in CI by using random container names GitHub Actions sets $CI=true; treat it like -r so parallel jobs don't all try to claim "infamy0" and clobber each other.	2026-04-28 10:06:04 +02:00
ael-bot	c7cdf6b018	Upgrade Linux kernel to 6.18.25	2026-04-27 16:47:37 +00:00
Tobias WaldekranzandGitHub	efa665de9c	Merge pull request #1472 from kernelkit/gptp ptp: initial support for IEEE 1588/802.1AS PTP/gPTP	2026-04-25 23:15:45 +02:00
Joachim Wiberg	4ece445c44	doc: update ChangeLog Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-24 14:30:09 +02:00
Joachim Wiberg	e1e2ada4b4	confd: fix review comments and code cleanup Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-24 14:30:09 +02:00
Joachim Wiberg	95bd795347	test: add some basic ptp tests Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-24 14:29:58 +02:00
Joachim Wiberg	3426c2527b	Add phc2sys companion service for BC/TC instances On multi-chip DSA hardware (e.g., boards with multiple mv88e6xxx chips), each switch chip has its own independent PHC device. With boundary_clock_jbod enabled, ptp4l starts but only disciplines the active slave port's PHC — the others drift. Automatically start phc2sys -a alongside any BC or TC instance using hardware timestamping. It subscribes to ptp4l's UDS socket, tracks BMCA, and disciplines all non-active PHCs to match the active one. On single-chip hardware it is a harmless no-op. CLOCK_REALTIME is intentionally left untouched. Syncing the system clock to PTP (phc2sys -rr), feeding the PHC from GPS/NTP (ts2phc, phc2sys reverse), and full multi-source coordination (timemaster) are planned as follow-on phases; see the issue tracker for the roadmap. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:10 +02:00
Joachim Wiberg	45b06dd670	Initial support for IEEE 1588/802.1AS PTP/gPTP Remaining work: - phc2sys YANG model (infix-phc2sys.yang, instance-index + servo params) - ts2phc YANG model (GPS/PPS → PHC → ptp4l GM path) - timemaster coordination (Phase 3, after phc2sys YANG is stable) - show ptp network (YANG action or background-polled topology container) - CMLDS (requires upstream linuxptp + 802.1ASdm foundation) - Full 12-bit sdoId, fault log, performance monitoring Backported patches from linuxptp master: - port: fix unicast negotiation recovery after FAULT_DETECTED - udp: fix port-specific ptp/p2p_dst_ipv4 configuration - pmc: avoid race conditions in agent update - phc2sys: wait until pmc agent is subscribed (startup race) - fix MAC driver incorrect SIOCGHWTSTAMP adjustment flags - pmc_agent: longer update interval when not subscribed - phc2sys: don't disable pmc agent with -s/-d/-w options - port_signaling: respect ptp_minor_version in message header - port: refresh link status on faults - uds: copy server socket ownership in pmc clients (non-root pmc) - uds: don't call chmod() on client socket - port: allow mixing wildcard and exact clock identities - Add pidfile support to ptp4l, phc2sys, and timemaster Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:09 +02:00
Joachim Wiberg	73b6e5cc91	patches/ethtool: backport support for --json -T (show time stamping) This is used by the next commit that adds initial support for PTP/gPTP. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:09 +02:00
Joachim Wiberg	b93795c0aa	board/common: add rauc upgrade bundle for ext4 images NOTE: this is intended only for use on devboards like EspressoBin where the onboard bootloader only understands fat and ext2 file systems. To enable, use 'make apply-ext4' Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:09 +02:00
Joachim Wiberg	5979f4e3c9	board/aarch64: fix bpi-r4 dip switch values Inverted values for eMMC and SPI NAND. Also use ABCD instead of Position as column name to match board markings. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:08 +02:00
Joachim Wiberg	2397e7684c	board/aarch64: drag Marvell ESPRESSObin in from the cold - Add a board README to explain how to get Infix running - Update mkimage.sh to allow creating images without boot loader Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-23 14:19:07 +02:00
Joachim WibergandGitHub	43d6dbc63f	Merge pull request #1478 from kernelkit/upgrade-buildroot	2026-04-23 13:00:41 +02:00
Mattias Walström	8ebdf9f119	Upgrade Buildroot to 2025.02.13 (LTS) A lot of CVEs fixed. Full changelog: https://github.com/buildroot/buildroot/blob/2025.02.x/CHANGES Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-04-23 10:44:43 +02:00
Mattias WalströmandGitHub	3aef9930fe	Merge pull request #1479 from kernelkit/kernel-upgrade-39c18ac9-3f99-4a96-bc62-daf538881c51 Upgrade to kernel 6.18.24	2026-04-23 09:50:44 +02:00
ael-bot	3ea1161f5f	Upgrade Linux kernel to 6.18.24	2026-04-23 05:42:15 +00:00
Joachim WibergandGitHub	091618c527	Merge pull request #1476 from kernelkit/misc Fix two regressions and add developer build helpers	2026-04-22 16:27:47 +02:00
Joachim WibergandGitHub	7647d2a542	Merge pull request #1477 from kernelkit/cosmetic-test-name-changes test: normalize test case names	2026-04-21 21:47:49 +02:00
Richard Alpe	f996dbd6ef	test: lowercase minor words in test case names Signed-off-by: Richard Alpe <richard@bit42.se>	2026-04-21 14:20:58 +02:00
Richard Alpe	ff02190df8	test: normalize suite/case names to title case Signed-off-by: Richard Alpe <richard@bit42.se>	2026-04-21 11:06:59 +02:00
Richard Alpe	c6f7b61683	test: add names to cases called from top level suite Signed-off-by: Richard Alpe <richard@bit42.se>	2026-04-21 11:06:57 +02:00
Joachim Wiberg	dbc3ba0c83	doc: update ChangeLog Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-20 13:03:29 +02:00
Joachim Wiberg	d039af7234	Fix #1458 : 'show ntp tracking' does not show reference id properly admin@gateway:~$ chronyc tracking Reference ID : C23ACD14 (svl1.ntp.netnod.se) Stratum : 2 Ref time (UTC) : Sun Apr 19 20:28:40 2026 System time : 0.000000000 seconds fast of NTP time Last offset : -17.822519302 seconds RMS offset : 17.822519302 seconds Frequency : 1064.750 ppm slow Residual freq : +0.581 ppm Skew : 0.794 ppm Root delay : 0.018065268 seconds Root dispersion : 0.000200240 seconds Update interval : 0.0 seconds Leap status : Normal vs admin@gateway:/> show ntp tracking Reference ID : 194.58.205.20 Stratum : 2 Ref time (UTC) : Sun Apr 19 20:28:40 2026 System time : 0.000000 seconds slow of NTP time Last offset : -17.822519302 seconds RMS offset : 17.822519302 seconds Frequency : 1064.750 ppm slow Residual freq : +0.581 ppm Skew : 0.794 ppm Root delay : 0.018065 seconds Root dispersion : 0.000188 seconds Update interval : 0.0 seconds Leap status : Normal Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-20 13:03:28 +02:00
Joachim Wiberg	59028c4800	Fix #1466 : 'show container' shows no output A container's command line, as reported by podman, may comtain environment variables, which the current regexp (added in `ed4fe58`) does not support. Extend the regexp to allow environment variables and add an operational, config false, 'cmdline' leaf node to allow any characters to be reported for the full command line in the operational output. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-20 13:02:37 +02:00
Joachim Wiberg	2603b0ea1b	Add support for developer config snippets Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-19 22:31:15 +02:00
Joachim Wiberg	4212a38c3b	.github: bump GitHub Actions to Node.js 24 compatible versions Fixes #1437 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-19 22:31:15 +02:00
Joachim Wiberg	bb72cfd8e3	doc: add missing image to device discovery section Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-19 22:31:14 +02:00
Joachim WibergandGitHub	a06786d36c	Merge pull request #1475 from kernelkit/kernel-upgrade-dfbe850e-9e05-4f30-b9b5-bd9399c6b718 Upgrade to kernel 6.18.23	2026-04-18 15:22:29 +02:00
ael-bot	16a173e20b	Upgrade Linux kernel to 6.18.23	2026-04-18 10:07:02 +00:00
Mattias WalströmandGitHub	6c38666229	Merge pull request #1473 from kernelkit/add-qualcomm	2026-04-17 18:59:32 +02:00
Mattias Walström	b940e14eb7	Add Qualcomm WiFi 6E support And replace lspci from busybox with pci-utils (for all platforms except arm (32bit).	2026-04-17 13:32:16 +02:00
Joachim WibergandGitHub	1774e08219	Merge pull request #1471 from kernelkit/kernel-upgrade-f52bac45-222b-4dda-86d4-50b617297422	2026-04-11 23:47:16 +02:00
ael-bot	5950e665ab	Upgrade Linux kernel to 6.18.22	2026-04-11 13:23:07 +00:00
Joachim WibergandGitHub	fadffef6cd	Merge pull request #1470 from kernelkit/bpi-r4-support Add support for Banana Pi BPI-R4	2026-04-10 14:05:07 +02:00
Joachim Wiberg	69d599e2ab	board/aarch64: add missing mmc partconf command to BPi-R64 U-Boot Also, simplify board README a bit now that we know that you don't need to flip the boot switch to program eMMC. [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-10 11:19:35 +02:00
Joachim Wiberg	6c879d81d1	configs/sama7g54: fix U-Boot build system selection Missing BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y caused Buildroot to default to legacy Makefile build system, which requires BR2_TARGET_UBOOT_BOARDNAME instead of BR2_TARGET_UBOOT_BOARD_DEFCONFIG, resulting in a build error. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-10 11:19:35 +02:00
Joachim Wiberg	e5b5b6203b	legal: add missing hash files and fix date-cpp hash filename Add missing *.hash files for all board packages using the ix-board macro; they declare LICENSE_FILES = LICENSE but had no hash file, producing a warning during make legal-info. Fix the date-cpp package where the hash file was named date.hash instead of date-cpp.hash (package name is derived from the directory, not the mk filename), causing Buildroot to skip the hash check entirely. Add hash files for local-site packages confd-test-mode, netd, and onieprom that declared LICENSE_FILES but provided no hash. Also, rename package/date-cpp/date.mk to date-cpp.mk. Buildroot derives the package name from the directory name, so the mk file must match. To handle the archive name different we set DATE_CPP_SOURCE. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-10 11:19:34 +02:00
Joachim Wiberg	31df56308b	board: add support for Banana Pi BPI-R4 Add board support for the BananaPi BPI-R4 router board, based on the MediaTek MT7988A (Filogic 880) SoC with quad-core Cortex-A73 CPU. The BPI-R4 is the successor to the BPI-R3 but uses entirely different silicon: the internal switch runs at 2.5 GbE per port, the two SFP+ uplinks use native USXGMII at up to 10 Gbps, and WiFi is provided by a MediaTek MT7996E PCIe module supporting tri-band WiFi 7 (2.4/5/6 GHz). Two board variants, BPI-R4-2g5 and BPI-R4P, replace one SFP+ cage with a 2.5 GbE RJ45 port (using the MT7988A internal 2.5G PHY); the R4P adds an optional PoE daughterboard on that port. Both use the upstream mt7988a-bananapi-bpi-r4-2g5 device tree. Interfaces: - Standard R4: eth1 (gmac1/sfp2 LAN cage) → sfp2, eth2 (gmac2/sfp1 WAN cage) → sfp1 - R4-2g5/R4P: eth1 (2.5G PHY) → wan, eth2 (gmac2/sfp1 WAN cage) → sfp1 Factory reset / WPS button (GPIO14, active-low): detected by U-Boot at boot for factory reset; reused by Linux as KEY_WPS_BUTTON at runtime. eMMC install note: the MT7988A eMMC (pins 38-49) and SD card (pins 32-37) use separate physical pads so there is no electrical bus sharing, unlike some BPi-R3 configurations. However, a single MMC controller (mmc@11230000) handles both, so only one is active per boot session. The eMMC install procedure therefore still requires an intermediate SPI NAND bootloader step until a Linux-side install path is tested. SD card build (bpi_r4_sd_boot_defconfig) now uses the new mt7988a_bpir4_sd U-Boot defconfig with cap-sd-highspeed enabled, giving 50 MHz SD transfers instead of the previous 25 MHz legacy mode. Also adds MT7988/MT7996 firmware support to the buildroot linux-firmware package, for 2.5 GbE port PHY and WiFi7 extension board, and updates the aarch64_defconfig, aarch64_minimal_defconfig, the arch README, CI boot/image workflows, mkimage.sh, and the ChangeLog. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-04-10 11:19:34 +02:00
Joachim WibergandGitHub	19c8c80294	Merge pull request #1468 from kernelkit/fix-rpi-display linux: Fix stability of Raspberry pi display 1	2026-04-05 05:55:02 +02:00
Mattias Walström	db422ecc5e	Update Changelog for new release cycle	2026-04-04 20:04:43 +02:00
Mattias Walström	5b870a273e	aarch64: dts: rpi-4: Add correct syntax to change GPU mem	2026-04-04 20:04:43 +02:00
Mattias Walström	e29e2093ab	linux: Fix stability of Raspberry pi display 1 This fix the instability of the display on soft reboots, previous it required a powercycle to get display to work properly Add patches from rpi-linux, and a small fixup from me. Signed-off-by: Mattias Walström <lazzer@gmail.com>	2026-04-04 20:04:43 +02:00
Mattias WalströmandGitHub	d5df85afad	Merge pull request #1467 from kernelkit/kernel-upgrade-ab8a1129-6fcc-4662-a366-1f0a309d1c13	2026-04-02 18:29:25 +02:00
ael-bot	003aee9b53	Upgrade Linux kernel to 6.18.21	2026-04-02 11:57:37 +00:00
Joachim WibergandGitHub	12a50a8523	Merge pull request #1463 from kernelkit/fix-dhcp-client-test test: dhcp: client_default_gw: Add longer timeout for test	2026-03-31 15:49:55 +02:00
Joachim Wiberg	bae80ba9d8	doc: bump release date Issue #1461 turned out to just be a flaky test, the change in this commit only bumps the release date. [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-31 15:41:08 +02:00
Mattias Walström	addd89e07e	test: dhcp: client_default_gw: Add longer timeout for test This fix #1461	2026-03-31 12:26:46 +02:00
Joachim WibergandGitHub	9014d7edb7	Merge pull request #1462 from kernelkit/changelog-update	2026-03-31 11:36:17 +02:00
Joachim Wiberg	c0475fc886	doc: update ChangeLog for v26.01.0, add missing entries Add several entries that were missing from the original release notes, most notably the SBSA watchdog fix for CN913x (Marvell Octeon) platforms and the BPI-R3 watchdog fix, plus show keystore, ixll scan, show system temperature, WiFi signal strength inversion fix, and follow command fix. [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-03-31 10:37:26 +02:00
				`@@ -0,0 +1 @@`
				`CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7988-emmc-env.dtsi"`