ssc325: add Chuangmi IPC017 device profile (SSC323, GC2053, MT7601U, 16M NOR) (#168)

Xiaomi/Chuangmi ipc017 kept on its vendor U-Boot. A kernel fragment appends mtdparts= with the vendor MXP offsets under OpenIPC's names plus panic=20, and carves a separate 64 KB env out of the end of the vendor DATA partition, because the vendor environment shares its erase block with the end of U-Boot. S01fwenv points fw_env.config at that partition. wireless/usb powers the MT7601U on GPIO 14 and bind-mounts a /tmp copy of MT7601USTA.dat with the factory MAC from FACTORY. S41eth0 takes the connector-less eth0 down so ONVIF discovery goes out on wlan0. Tested on hardware.

.github/firmware-drift.json

@@ -434,6 +434,13 @@
       "reconciled": "2026-08-25",
       "note": "vendor driver loader; firmware#2307 updated its sensor list"
     },
+    {
+      "builder": "devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/wireless/usb",
+      "firmware": "general/overlay/etc/wireless/usb",
+      "blob": "f9df96bc190e8f8a11794f9410568eac10f50320",
+      "reconciled": "2026-09-25",
+      "note": "only the mt7601u-ssc325-chuangmi-ipc017 arm"
+    },
     {
       "builder": "devices/ssc325_lite_imou-c22cp/general/overlay/etc/wireless/usb",
       "firmware": "general/overlay/etc/wireless/usb",

README.md

@@ -23,6 +23,7 @@ Botslab C213             T23N         SC3332    ATBM6012B_USB    NOR_8M    **INI
 CCDCAM IM50Q01           SSC377QE     IMX335    -                NOR_16M   done
 ChinaTelecom DS-YTJ5301  SSC30KD      GC2053    RTL8188FU_USB    NOR_16M   video-ok, wifi-no, motors-no
 ChinaTelecom Y4H-50      T31L         ?         ?                NOR_16M   new
+Chuangmi IPC017          SSC323       GC2053    MT7601U_USB      NOR_16M   video-yes, wifi-yes, ir-yes (vendor U-Boot)
 CMCC HDC-51 A5-V12       T21N         SC2235    RTL8189FTV_SDIO  NOR_16M   done
 CMCC HDC-51 A6-V10       T31L         JXF37     RTL8188FU_USB    NOR_16M   done
 CMCC HDC-51 A6-V11       T31L         SC2332    RTL8188FU_USB    NOR_16M   done

devices/ssc325_lite_chuangmi-ipc017/br-ext-chip-sigmastar/board/infinity6/fragments/chuangmi-ipc017.config

@@ -0,0 +1,10 @@
+# The ipc017 keeps its vendor U-Boot, whose bootargs carry neither panic= nor
+# mtdparts=, so append both. Without mtdparts= the kernel falls back to the
+# vendor MXP table (BOOT, KERNEL, ROOTFS, DATA, CONFIG, FACTORY). These keep its
+# offsets under OpenIPC's names, so /init and sysupgrade find rootfs_data,
+# kernel and rootfs, and turn the last 64 KB of the vendor DATA partition into
+# an env of its own: the vendor environment shares its erase block with the end
+# of U-Boot and must not be written.
+CONFIG_CMDLINE="mtdparts=NOR_FLASH:320k(boot)ro,2048k(kernel),7552k(rootfs),6272k(rootfs_data),64k(env),64k(config)ro,64k(factory)ro panic=20"
+# CONFIG_CMDLINE_FROM_BOOTLOADER is not set
+CONFIG_CMDLINE_EXTEND=y

devices/ssc325_lite_chuangmi-ipc017/br-ext-chip-sigmastar/configs/ssc325_lite_chuangmi-ipc017_defconfig

@@ -0,0 +1,70 @@
+# Architecture
+BR2_arm=y
+BR2_cortex_a7=y
+BR2_ARM_FPU_NEON_VFPV4=y
+BR2_ARM_INSTRUCTIONS_THUMB2=y
+
+# Toolchain
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
+BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
+BR2_TOOLCHAIN_EXTERNAL_URL="https://github.com/openipc/firmware/releases/download/$(OPENIPC_TOOLCHAIN).tgz"
+BR2_TOOLCHAIN_EXTERNAL_CUSTOM_PREFIX="arm-openipc-linux-musleabihf"
+BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_9=y
+BR2_TOOLCHAIN_EXTERNAL_CUSTOM_MUSL=y
+BR2_TOOLCHAIN_EXTERNAL_CXX=y
+
+# Kernel
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/openipc/linux/archive/$(OPENIPC_KERNEL).tar.gz"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(EXTERNAL_VENDOR)/board/$(OPENIPC_SOC_FAMILY)/infinity6-ssc009a.config"
+BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(EXTERNAL_VENDOR)/board/$(OPENIPC_SOC_FAMILY)/fragments/chuangmi-ipc017.config"
+BR2_LINUX_KERNEL_UIMAGE=y
+BR2_LINUX_KERNEL_XZ=y
+
+# Filesystem
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
+BR2_PACKAGE_EXFATPROGS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
+BR2_PACKAGE_ZLIB=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_WIREGUARD_LINUX_COMPAT=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
+BR2_PACKAGE_WIRELESS_TOOLS=y
+BR2_PACKAGE_WPA_SUPPLICANT=y
+BR2_PACKAGE_WPA_SUPPLICANT_CLI=y
+BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
+BR2_TARGET_ROOTFS_CPIO=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
+
+# OpenIPC
+BR2_OPENIPC_SOC_VENDOR="sigmastar"
+BR2_OPENIPC_SOC_MODEL="ssc325"
+BR2_OPENIPC_SOC_FAMILY="infinity6"
+BR2_OPENIPC_VARIANT="lite"
+BR2_OPENIPC_FLASH_SIZE="16"
+
+# Packages
+BR2_PACKAGE_DROPBEAR_OPENIPC=y
+BR2_PACKAGE_EXFAT_OPENIPC=y
+BR2_PACKAGE_IPCTOOL=y
+BR2_PACKAGE_LIBCURL_OPENIPC=y
+BR2_PACKAGE_LIBCURL_OPENIPC_CURL=y
+# BR2_PACKAGE_LIBCURL_OPENIPC_PROXY_SUPPORT is not set
+# BR2_PACKAGE_LIBCURL_OPENIPC_COOKIES_SUPPORT is not set
+# BR2_PACKAGE_LIBCURL_OPENIPC_EXTRA_PROTOCOLS_FEATURES is not set
+BR2_PACKAGE_LIBEVENT_OPENIPC=y
+BR2_PACKAGE_LIBOGG_OPENIPC=y
+BR2_PACKAGE_MAJESTIC_FONTS=y
+BR2_PACKAGE_MAJESTIC_WEBUI=y
+BR2_PACKAGE_MAJESTIC=y
+BR2_PACKAGE_MBEDTLS_OPENIPC=y
+BR2_PACKAGE_MT7601U_OPENIPC=y
+BR2_PACKAGE_OPUS_OPENIPC=y
+BR2_PACKAGE_OPUS_OPENIPC_FIXED_POINT=y
+BR2_PACKAGE_SIGMASTAR_OSDRV_INFINITY6=y
+BR2_PACKAGE_VTUND_OPENIPC=y
+BR2_PACKAGE_YAML_CLI=y

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/init.d/S01fwenv

@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# The vendor U-Boot keeps its environment in the erase block that also holds the
+# end of U-Boot, so fw_setenv must never reach it. This profile's mtdparts gives
+# the environment a 64 KB partition of its own: point fw_printenv and fw_setenv
+# at it, and at nothing while the vendor partitions are still in use.
+
+case "$1" in
+	start)
+		env=$(awk -F: '/"env"/ {print $1}' /proc/mtd)
+		if [ -n "$env" ]; then
+			line="/dev/$env 0x0 0x10000 0x10000"
+			[ "$(cat /etc/fw_env.config 2>/dev/null)" = "$line" ] ||
+				echo "$line" > /etc/fw_env.config
+		else
+			rm -f /etc/fw_env.config
+		fi
+		;;
+
+	stop)
+		;;
+
+	*)
+		echo "Usage: $0 {start|stop}"
+		exit 1
+		;;
+esac

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/init.d/S41eth0

@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+# The ipc017 has no Ethernet connector, but the SoC still registers eth0 and
+# S40network gives it a fallback address, so majestic sends its ONVIF discovery
+# there instead of on wlan0. Take eth0 down while it has no carrier.
+
+case "$1" in
+	start)
+		if [ "$(cat /sys/class/net/eth0/carrier 2>/dev/null)" = 0 ]; then
+			ip addr flush dev eth0
+			ip link set dev eth0 down
+		fi
+		;;
+
+	stop)
+		;;
+
+	*)
+		echo "Usage: $0 {start|stop}"
+		exit 1
+		;;
+esac

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/wireless/usb

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+set_gpio() {
+	[ "$2" -eq 1 ] && gpio set $1 || gpio clear $1
+	sleep 1
+}
+
+# GPIO 14 powers the MT7601U. The vendor FACTORY partition holds the factory
+# MAC as a NUL-separated mac=XX:XX:XX:XX:XX:XX record; mt7601sta takes it from
+# MacAddress= in its .dat file. That path is compiled into the driver, so the
+# edited copy lives in /tmp and is bind-mounted over it: editing it in place
+# would copy the .dat up into the overlay, where it would shadow the one a
+# later firmware ships.
+if [ "$1" = "mt7601u-ssc325-chuangmi-ipc017" ]; then
+	set_gpio 14 1
+	dat=/etc/mediatek/MT7601USTA.dat
+	factory=$(awk -F: '/"(factory|FACTORY)"/ {print $1}' /proc/mtd)
+	mac=$([ -n "$factory" ] && tr '\0' '\n' < "/dev/$factory" | sed -n 's/^mac=//p')
+	if [ -n "$mac" ] && ! grep -qx "MacAddress=$mac" $dat; then
+		sed '/^MacAddress=/d' $dat > /tmp/MT7601USTA.dat
+		echo "MacAddress=$mac" >> /tmp/MT7601USTA.dat
+		mount --bind /tmp/MT7601USTA.dat $dat
+	fi
+	modprobe mt7601sta
+	exit 0
+fi
+
+exit 1

devices/ssc325_lite_chuangmi-ipc017/general/overlay/usr/share/openipc/customizer.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+#
+# Perform basic settings on a known IP camera
+#
+#
+# Set custom upgrade url
+#
+fw_setenv upgrade 'https://github.com/OpenIPC/builder/releases/download/latest/ssc325_lite_chuangmi-ipc017-nor.tgz'
+#
+#
+# Set custom majestic settings
+#
+cli -s .nightMode.irCutPin1 78
+cli -s .nightMode.irCutPin2 79
+cli -s .nightMode.backlightPin 52
+cli -s .nightMode.lightMonitor true
+cli -s .nightMode.autoNightGain 8
+#
+#
+# Set wlan device and credentials if need
+#
+fw_setenv wlandev mt7601u-ssc325-chuangmi-ipc017
+#fw_setenv wlanssid Router
+#fw_setenv wlanpass 12345678
+
+exit 0

devices/ssc325_lite_chuangmi-ipc017/general/scripts/excludes/ssc325_lite.list

@@ -0,0 +1,9 @@
+/etc/sensors/imx307.bin
+/etc/sensors/sc2239.bin
+/etc/sensors/sc2335.bin
+#
+/lib/modules/4.9.84/sigmastar/sensor_imx307_mipi.ko
+/lib/modules/4.9.84/sigmastar/sensor_sc2239_mipi.ko
+/lib/modules/4.9.84/sigmastar/sensor_sc2239_parl.ko
+/lib/modules/4.9.84/sigmastar/sensor_sc2335_mipi.ko
+/lib/modules/4.9.84/sigmastar/sensor_sc2335_parl.ko