compared to bpi-r3 fip on r4 is at position 0x580000 (plat/mediatek/mt7988/bl2/bl2_dev_spi_nand.c #define FIP_BASE 0x580000)

BPI-R4> mtd list
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, O4
List of MTD devices:
* spi-nand0
  - device: spi_nand@0
  - parent: spi@1100a000
  - driver: spi_nand
  - path: /spi@1100a000/spi_nand@0
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 64 bytes
  - OOB available: 24 bytes
  - 0x000000000000-0x000008000000 : "spi-nand0"
BPI-R4> ls usb 0:1 u-boot_2024-10
            ./
            ../
   254821   bpi-r4_spim-nand_bl2.img
   295477   bpi-r4_spim-nand_fip.bin
   295409   bpi-r4_emmc_fip.bin
   246069   bpi-r4_emmc_bl2.img
  7874804   bpi-r4_emmc.img.gz

5 file(s), 2 dir(s)

BPI-R4> mtd erase spi-nand0
Erasing 0x00000000 ... 0x07ffffff (1024 eraseblock(s))
BPI-R4> load usb 0:1 $loadaddr u-boot_2024-10/bpi-r4_spim-nand_bl2.img
254821 bytes read in 29 ms (8.4 MiB/s)
BPI-R4> mtd write spi-nand0 $loadaddr 0x0 0x100000
Writing 1048576 byte(s) (512 page(s)) at offset 0x00000000
BPI-R4>
BPI-R4> load usb 0:1 $loadaddr u-boot_2024-10/bpi-r4_spim-nand_fip.bin
295477 bytes read in 35 ms (8.1 MiB/s)
BPI-R4> mtd write spi-nand0 $loadaddr 0x580000 0x200000
Writing 2097152 byte(s) (1024 page(s)) at offset 0x00580000
BPI-R4> 

https://github.com/u-boot/u-boot/blob/master/doc/README.ubi

flashing ubi bl2:

fatload usb 0:1 $loadaddr 2025.04/bpi-r4_spim-nand_ubi_bl2.img
BPI-R4> mtd erase spi-nand0 0x0 0x100000                              
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
BPI-R4> mtd write spi-nand0 $loadaddr 0x0 0x100000
Writing 1048576 byte(s) (512 page(s)) at offset 0x00000000

access to ubifs (created/filled on linux):

BPI-R4> ubi part ubi
jedec_spi_nor spi_nor@0: unrecognized JEDEC id bytes: ff, ff, ff
ubi0: attaching mtd2
ubi0: scanning is finished
ubi0: attached mtd2 (name "ubi", size 126 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 1008, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 505724658
ubi0: available PEBs: 0, total reserved PEBs: 1008, PEBs reserved for bad PEB handling: 20
BPI-R4> ubi list
0: fip
1: ubootenv
2: ubootenv2
3: rootfs

BPI-R4> ubifsmount ubi0:rootfs
UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "rootfs", R/O mode
UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:3): FS size: 121896960 bytes (116 MiB, 960 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS (ubi0:3): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:3): media format: w4/r0 (latest is w4/r0), UUID 3029A899-CC2E-4178-B326-B693BD7502A0, small LPT model
BPI-R4> ubifsls
         16802850  Thu Mar 06 15:46:07 2025  rootfs_bpi-r3.cpio_lvm.zst
          9707432  Thu Mar 06 15:46:32 2025  bpi-r4-6.16-mt7988upstream.itb
#BPI-R4> ubifsload ${loadaddr} bpi-r4-6.16-mt7988upstream.itb
#Loading file 'bpi-r4-6.16-mt7988upstream.itb' to addr 0x46000000...
#Done
BPI-R4> load ubi 0:3 ${loadaddr} bpi-r4-6.16-mt7988upstream.itb
9707432 bytes read in 1089 ms (8.5 MiB/s)
BPI-R4> ubifsumount
Unmounting UBIFS volume rootfs!

how to display uboot devicetree

BPI-R4> bdinfo
...
fdt_blob    = 0x00000000ff7fbc90
...
BPI-R4> fdt addr 0x00000000ff7fbc90
BPI-R4> fdt list
BPI-R4> fdt print /pcie@11290000

BPI-R4> pinmux list                                                             
| Device                        | Driver                        | Parent        
| pinctrl@1001f000              | mt7988_pinctrl                | root_driver   
BPI-R4> pinmux dev pinctrl@1001f000                                             
dev: pinctrl@1001f000                                                           
BPI-R4> pinmux status                                                           
...
PCIE30_2L : Aux Func.1                                                          
PCIE30_2L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1                                                          
...
PCIE30_2L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1                                                          
...
PCIE30_2L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1                                                          
PCIE30_2L : Aux Func.1                                                          
PCIE30_2L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1                                                          
PCIE30_1L : Aux Func.1

BPI-R4> clk dump                                                                
 Rate               Usecnt      Name                                            
------------------------------------------                                      
 40000000             0        |-- dummy40m                                     
 208000000            0        |-- dummy208m                                    
 12000000             0        |-- dummy12m                                     
BPI-R4>

https://forum.banana-pi.org/t/bpi-r4-u-boot-i2c/23454/9?u=frank-w

BPI-R4> i2c bus
Bus 0:  i2c@11004000
Bus 1:  i2c@11005000
   70: i2c-mux@70, offset len 1, flags 0
Bus 2:  i2c@11005000->i2c-mux@70->i2c@0
   57: eeprom@57, offset len 1, flags 0
BPI-R4> i2c dev 2
Setting bus to 2
BPI-R4> i2c probe
BPI-R4> i2c md 0x57 0 5
0000: 74 65 73 74 0a    test.
BPI-R4> i2c read 0x57 0 5 $loadaddr
BPI-R4> md.b $loadaddr 5
46000000: 74 65 73 74 0a       test.