hilink: bake WFB management and low latency runtime

.gitea/workflows/build-hilink.yml

@@ -0,0 +1,66 @@
+name: Build HiLink URLLC firmware
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: openipc-builder
+    timeout-minutes: 360
+    env:
+      DEVICE: ssc338q_fpv_openipc-urllc-aio
+      BR2_DL_DIR: /tmp/builder-dl
+
+    steps:
+      - name: Checkout builder branch
+        uses: actions/checkout@v4
+
+      - name: Verify provisioned Buildroot toolchain
+        shell: bash
+        run: |
+          set -eu
+          id
+          missing=0
+          for tool in \
+            bash bc bison ccache cpio curl file flex gawk gcc git gzip make \
+            patch perl python3 rsync sed tar tree unzip wget xz; do
+            if ! command -v "$tool" >/dev/null 2>&1; then
+              echo "::error::Missing runner dependency: $tool"
+              missing=1
+            fi
+          done
+          test "$missing" = 0
+
+      - name: Build exactly the HiLink URLLC profile
+        shell: bash
+        run: |
+          set -euo pipefail
+          export GIT_HASH="$(git rev-parse --short HEAD)"
+          export GIT_BRANCH="$(git branch --show-current)"
+          mkdir -p "$BR2_DL_DIR" /tmp/ccache
+          ln -s /tmp/ccache "$HOME/.ccache"
+
+          if ! bash builder.sh "$DEVICE"; then
+            echo '--- largest files retained in the failed rootfs ---'
+            find openipc/output/target -type f -printf '%s\t%p\n' | \
+              sort -nr | sed -n '1,100p' || true
+            echo '--- rootfs target usage ---'
+            du -sh openipc/output/target 2>/dev/null || true
+            exit 1
+          fi
+
+          mkdir -p dist
+          firmware=$(find openipc/output/images -type f -name 'openipc*nor*.tgz' -print -quit)
+          test -n "$firmware"
+          cp "$firmware" "dist/${DEVICE}-nor.tgz"
+          sha256sum "dist/${DEVICE}-nor.tgz" > "dist/${DEVICE}-nor.tgz.sha256"
+
+          find dist -maxdepth 1 -type f -printf '%f %s bytes\n'
+          cat "dist/${DEVICE}-nor.tgz.sha256"
+
+      - name: Upload firmware artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: hilink-urllc-${{ github.sha }}
+          retention-days: 30
+          path: dist/*

.github/firmware-drift.json

@@ -434,13 +434,6 @@
       "reconciled": "2026-08-25",
       "note": "vendor driver loader; firmware#2307 updated its sensor list"
     },
-    {
-      "builder": "devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/wireless/usb",
-      "firmware": "general/overlay/etc/wireless/usb",
-      "blob": "f9df96bc190e8f8a11794f9410568eac10f50320",
-      "reconciled": "2026-09-25",
-      "note": "only the mt7601u-ssc325-chuangmi-ipc017 arm"
-    },
     {
       "builder": "devices/ssc325_lite_imou-c22cp/general/overlay/etc/wireless/usb",
       "firmware": "general/overlay/etc/wireless/usb",

README.md

@@ -23,7 +23,6 @@ Botslab C213             T23N         SC3332    ATBM6012B_USB    NOR_8M    **INI
 CCDCAM IM50Q01           SSC377QE     IMX335    -                NOR_16M   done
 ChinaTelecom DS-YTJ5301  SSC30KD      GC2053    RTL8188FU_USB    NOR_16M   video-ok, wifi-no, motors-no
 ChinaTelecom Y4H-50      T31L         ?         ?                NOR_16M   new
-Chuangmi IPC017          SSC323       GC2053    MT7601U_USB      NOR_16M   video-yes, wifi-yes, ir-yes (vendor U-Boot)
 CMCC HDC-51 A5-V12       T21N         SC2235    RTL8189FTV_SDIO  NOR_16M   done
 CMCC HDC-51 A6-V10       T31L         JXF37     RTL8188FU_USB    NOR_16M   done
 CMCC HDC-51 A6-V11       T31L         SC2332    RTL8188FU_USB    NOR_16M   done

ci/Dockerfile

@@ -0,0 +1,35 @@
+FROM debian:bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      bash \
+      bc \
+      bison \
+      build-essential \
+      ca-certificates \
+      ccache \
+      cpio \
+      curl \
+      file \
+      flex \
+      gawk \
+      git \
+      gzip \
+      libncurses-dev \
+      make \
+      nodejs \
+      patch \
+      perl \
+      python3 \
+      rsync \
+      sed \
+      tar \
+      tree \
+      unzip \
+      wget \
+      xz-utils \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace

devices/ssc325_lite_chuangmi-ipc017/br-ext-chip-sigmastar/board/infinity6/fragments/chuangmi-ipc017.config

@@ -1,10 +0,0 @@
-# The ipc017 keeps its vendor U-Boot, whose bootargs carry neither panic= nor
-# mtdparts=, so append both. Without mtdparts= the kernel falls back to the
-# vendor MXP table (BOOT, KERNEL, ROOTFS, DATA, CONFIG, FACTORY). These keep its
-# offsets under OpenIPC's names, so /init and sysupgrade find rootfs_data,
-# kernel and rootfs, and turn the last 64 KB of the vendor DATA partition into
-# an env of its own: the vendor environment shares its erase block with the end
-# of U-Boot and must not be written.
-CONFIG_CMDLINE="mtdparts=NOR_FLASH:320k(boot)ro,2048k(kernel),7552k(rootfs),6272k(rootfs_data),64k(env),64k(config)ro,64k(factory)ro panic=20"
-# CONFIG_CMDLINE_FROM_BOOTLOADER is not set
-CONFIG_CMDLINE_EXTEND=y

devices/ssc325_lite_chuangmi-ipc017/br-ext-chip-sigmastar/configs/ssc325_lite_chuangmi-ipc017_defconfig

@@ -1,70 +0,0 @@
-# Architecture
-BR2_arm=y
-BR2_cortex_a7=y
-BR2_ARM_FPU_NEON_VFPV4=y
-BR2_ARM_INSTRUCTIONS_THUMB2=y
-
-# Toolchain
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
-BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
-BR2_TOOLCHAIN_EXTERNAL_URL="https://github.com/openipc/firmware/releases/download/$(OPENIPC_TOOLCHAIN).tgz"
-BR2_TOOLCHAIN_EXTERNAL_CUSTOM_PREFIX="arm-openipc-linux-musleabihf"
-BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_9=y
-BR2_TOOLCHAIN_EXTERNAL_CUSTOM_MUSL=y
-BR2_TOOLCHAIN_EXTERNAL_CXX=y
-
-# Kernel
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/openipc/linux/archive/$(OPENIPC_KERNEL).tar.gz"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(EXTERNAL_VENDOR)/board/$(OPENIPC_SOC_FAMILY)/infinity6-ssc009a.config"
-BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(EXTERNAL_VENDOR)/board/$(OPENIPC_SOC_FAMILY)/fragments/chuangmi-ipc017.config"
-BR2_LINUX_KERNEL_UIMAGE=y
-BR2_LINUX_KERNEL_XZ=y
-
-# Filesystem
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL)/package/busybox/busybox.config"
-BR2_PACKAGE_EXFATPROGS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
-BR2_PACKAGE_ZLIB=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_WIREGUARD_LINUX_COMPAT=y
-BR2_PACKAGE_WIREGUARD_TOOLS=y
-BR2_PACKAGE_WIRELESS_TOOLS=y
-BR2_PACKAGE_WPA_SUPPLICANT=y
-BR2_PACKAGE_WPA_SUPPLICANT_CLI=y
-BR2_PACKAGE_WPA_SUPPLICANT_PASSPHRASE=y
-BR2_TARGET_ROOTFS_CPIO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-BR2_TARGET_ROOTFS_SQUASHFS4_XZ=y
-
-# OpenIPC
-BR2_OPENIPC_SOC_VENDOR="sigmastar"
-BR2_OPENIPC_SOC_MODEL="ssc325"
-BR2_OPENIPC_SOC_FAMILY="infinity6"
-BR2_OPENIPC_VARIANT="lite"
-BR2_OPENIPC_FLASH_SIZE="16"
-
-# Packages
-BR2_PACKAGE_DROPBEAR_OPENIPC=y
-BR2_PACKAGE_EXFAT_OPENIPC=y
-BR2_PACKAGE_IPCTOOL=y
-BR2_PACKAGE_LIBCURL_OPENIPC=y
-BR2_PACKAGE_LIBCURL_OPENIPC_CURL=y
-# BR2_PACKAGE_LIBCURL_OPENIPC_PROXY_SUPPORT is not set
-# BR2_PACKAGE_LIBCURL_OPENIPC_COOKIES_SUPPORT is not set
-# BR2_PACKAGE_LIBCURL_OPENIPC_EXTRA_PROTOCOLS_FEATURES is not set
-BR2_PACKAGE_LIBEVENT_OPENIPC=y
-BR2_PACKAGE_LIBOGG_OPENIPC=y
-BR2_PACKAGE_MAJESTIC_FONTS=y
-BR2_PACKAGE_MAJESTIC_WEBUI=y
-BR2_PACKAGE_MAJESTIC=y
-BR2_PACKAGE_MBEDTLS_OPENIPC=y
-BR2_PACKAGE_MT7601U_OPENIPC=y
-BR2_PACKAGE_OPUS_OPENIPC=y
-BR2_PACKAGE_OPUS_OPENIPC_FIXED_POINT=y
-BR2_PACKAGE_SIGMASTAR_OSDRV_INFINITY6=y
-BR2_PACKAGE_VTUND_OPENIPC=y
-BR2_PACKAGE_YAML_CLI=y

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/init.d/S01fwenv

@@ -1,27 +0,0 @@
-#!/bin/sh
-#
-# The vendor U-Boot keeps its environment in the erase block that also holds the
-# end of U-Boot, so fw_setenv must never reach it. This profile's mtdparts gives
-# the environment a 64 KB partition of its own: point fw_printenv and fw_setenv
-# at it, and at nothing while the vendor partitions are still in use.
-
-case "$1" in
-	start)
-		env=$(awk -F: '/"env"/ {print $1}' /proc/mtd)
-		if [ -n "$env" ]; then
-			line="/dev/$env 0x0 0x10000 0x10000"
-			[ "$(cat /etc/fw_env.config 2>/dev/null)" = "$line" ] ||
-				echo "$line" > /etc/fw_env.config
-		else
-			rm -f /etc/fw_env.config
-		fi
-		;;
-
-	stop)
-		;;
-
-	*)
-		echo "Usage: $0 {start|stop}"
-		exit 1
-		;;
-esac

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/init.d/S41eth0

@@ -1,22 +0,0 @@
-#!/bin/sh
-#
-# The ipc017 has no Ethernet connector, but the SoC still registers eth0 and
-# S40network gives it a fallback address, so majestic sends its ONVIF discovery
-# there instead of on wlan0. Take eth0 down while it has no carrier.
-
-case "$1" in
-	start)
-		if [ "$(cat /sys/class/net/eth0/carrier 2>/dev/null)" = 0 ]; then
-			ip addr flush dev eth0
-			ip link set dev eth0 down
-		fi
-		;;
-
-	stop)
-		;;
-
-	*)
-		echo "Usage: $0 {start|stop}"
-		exit 1
-		;;
-esac

devices/ssc325_lite_chuangmi-ipc017/general/overlay/etc/wireless/usb

@@ -1,28 +0,0 @@
-#!/bin/sh
-
-set_gpio() {
-	[ "$2" -eq 1 ] && gpio set $1 || gpio clear $1
-	sleep 1
-}
-
-# GPIO 14 powers the MT7601U. The vendor FACTORY partition holds the factory
-# MAC as a NUL-separated mac=XX:XX:XX:XX:XX:XX record; mt7601sta takes it from
-# MacAddress= in its .dat file. That path is compiled into the driver, so the
-# edited copy lives in /tmp and is bind-mounted over it: editing it in place
-# would copy the .dat up into the overlay, where it would shadow the one a
-# later firmware ships.
-if [ "$1" = "mt7601u-ssc325-chuangmi-ipc017" ]; then
-	set_gpio 14 1
-	dat=/etc/mediatek/MT7601USTA.dat
-	factory=$(awk -F: '/"(factory|FACTORY)"/ {print $1}' /proc/mtd)
-	mac=$([ -n "$factory" ] && tr '\0' '\n' < "/dev/$factory" | sed -n 's/^mac=//p')
-	if [ -n "$mac" ] && ! grep -qx "MacAddress=$mac" $dat; then
-		sed '/^MacAddress=/d' $dat > /tmp/MT7601USTA.dat
-		echo "MacAddress=$mac" >> /tmp/MT7601USTA.dat
-		mount --bind /tmp/MT7601USTA.dat $dat
-	fi
-	modprobe mt7601sta
-	exit 0
-fi
-
-exit 1

devices/ssc325_lite_chuangmi-ipc017/general/overlay/usr/share/openipc/customizer.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-#
-# Perform basic settings on a known IP camera
-#
-#
-# Set custom upgrade url
-#
-fw_setenv upgrade 'https://github.com/OpenIPC/builder/releases/download/latest/ssc325_lite_chuangmi-ipc017-nor.tgz'
-#
-#
-# Set custom majestic settings
-#
-cli -s .nightMode.irCutPin1 78
-cli -s .nightMode.irCutPin2 79
-cli -s .nightMode.backlightPin 52
-cli -s .nightMode.lightMonitor true
-cli -s .nightMode.autoNightGain 8
-#
-#
-# Set wlan device and credentials if need
-#
-fw_setenv wlandev mt7601u-ssc325-chuangmi-ipc017
-#fw_setenv wlanssid Router
-#fw_setenv wlanpass 12345678
-
-exit 0

devices/ssc325_lite_chuangmi-ipc017/general/scripts/excludes/ssc325_lite.list

@@ -1,9 +0,0 @@
-/etc/sensors/imx307.bin
-/etc/sensors/sc2239.bin
-/etc/sensors/sc2335.bin
-#
-/lib/modules/4.9.84/sigmastar/sensor_imx307_mipi.ko
-/lib/modules/4.9.84/sigmastar/sensor_sc2239_mipi.ko
-/lib/modules/4.9.84/sigmastar/sensor_sc2239_parl.ko
-/lib/modules/4.9.84/sigmastar/sensor_sc2335_mipi.ko
-/lib/modules/4.9.84/sigmastar/sensor_sc2335_parl.ko

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/init.d/S40network

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+start() {
+    echo "Starting network..."
+    ifup lo
+    modprobe 8812eu rtw_tx_pwr_by_rate=0 rtw_tx_pwr_lmt_enable=0
+}
+
+stop() {
+    ifdown lo
+    ifdown -f wlan0
+    ifdown -f eth0
+}
+
+case "$1" in
+    start|stop) "$1" ;;
+    restart|reload) stop; start ;;
+    *) echo "Usage: $0 {start|stop|restart|reload}"; exit 1 ;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/init.d/S41mgmt-net

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+case "$1" in
+    start)
+        ifdown eth0 2>/dev/null || true
+        ifup eth0
+        sleep 5
+        /usr/bin/mgmt-net --force
+
+        if [ -r /run/mgmt-netd.pid ] &&
+           kill -0 "$(cat /run/mgmt-netd.pid)" 2>/dev/null; then
+            exit 0
+        fi
+
+        (
+            while :; do
+                /usr/bin/mgmt-net
+                sleep 2
+            done
+        ) &
+        echo $! >/run/mgmt-netd.pid
+        ;;
+
+    stop)
+        [ -r /run/mgmt-netd.pid ] &&
+          kill "$(cat /run/mgmt-netd.pid)" 2>/dev/null || true
+        rm -f /run/mgmt-netd.pid /run/mgmt-net.state
+        ;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/init.d/S97link-monitor

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+case "$1" in
+    start)
+        pidof wfb_tx wfb_rx wfb_tun wifilink >/dev/null && exit 0
+        pidof msposd >/dev/null && exit 0
+
+        size=$(curl -s localhost/api/v1/config.json | \
+          jsonfilter -qe "@.video0.size")
+        size="${size:-1280x720}"
+
+        msposd \
+          -b 115200 \
+          -c 8 \
+          -c 6 \
+          -p 500 \
+          -w 1000 \
+          -r 20 \
+          -m /dev/ttyS2 \
+          -o 127.0.0.1:14551 \
+          -z "$size" \
+          >/tmp/msposd-management.log 2>&1 &
+        ;;
+
+    *)
+        exit 0
+        ;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/init.d/wifibroadcast

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+case "$1" in
+	start)
+		echo "Starting wifibroadcast..."
+		wifibroadcast start
+		;;
+
+	stop)
+		echo "Stopping wifibroadcast..."
+		wifibroadcast stop
+		;;
+
+	*)
+		echo "Usage: $0 {start|stop}"
+		exit 1
+		;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/majestic.yaml

@@ -0,0 +1,81 @@
+system:
+  webPort: 80
+  httpsPort: 443
+  logLevel: info
+isp:
+  antiFlicker: disabled
+  sensorConfig: /etc/sensors/imx415_fpv.bin
+  exposure: 5
+  iqServer: false
+image:
+  mirror: false
+  flip: false
+  rotate: 0
+  contrast: 50
+  hue: 50
+  saturation: 50
+  luminance: 50
+video0:
+  enabled: true
+  codec: h264
+  fps: 60
+  bitrate: 4096
+  rcMode: cbr
+  gopSize: 0.2
+  size: 1280x720
+  profile: main
+  sliceUnits: 0
+video1:
+  enabled: false
+  codec: h264
+  size: 704x576
+  fps: 15
+jpeg:
+  enabled: true
+  qfactor: 50
+  fps: 5
+osd:
+  enabled: false
+  font: /usr/share/fonts/truetype/UbuntuMono-Regular.ttf
+  template: '%d.%m.%Y %H:%M:%S'
+  posX: 16
+  posY: 16
+audio:
+  enabled: false
+  volume: 30
+  srate: 8000
+  codec: opus
+  outputEnabled: false
+  outputVolume: 30
+rtsp:
+  enabled: false
+  port: 554
+nightMode:
+  colorToGray: true
+  irCutSingleInvert: false
+  lightMonitor: false
+  lightSensorInvert: false
+motionDetect:
+  enabled: false
+  visualize: false
+  debug: false
+records:
+  enabled: false
+  path: /mnt/mmcblk0p1/%F
+  split: 1
+  maxUsage: 95
+  notime: true
+outgoing:
+  enabled: true
+  naluSize: 1400
+  wfb: true
+  server:
+  substream: false
+watchdog:
+  enabled: true
+  timeout: 300
+hls:
+  enabled: false
+fpv:
+  enabled: true
+  noiseLevel: 1

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/network/interfaces.d/eth0

@@ -0,0 +1,6 @@
+iface eth0 inet static
+    hwaddress ether $(fw_printenv -n ethaddr || echo 00:00:23:34:45:66)
+    address 192.168.0.10
+    netmask 255.255.255.0
+    gateway 192.168.0.1
+    post-up echo "nameserver 1.1.1.1" > /etc/resolv.conf

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/network/interfaces.d/wlan0

@@ -0,0 +1,10 @@
+auto wlan0
+iface wlan0 inet static
+    address 192.168.0.10
+    netmask 255.255.255.0
+    gateway 192.168.0.1
+    pre-up wpa_passphrase "$(fw_printenv -n wlanssid)" "$(fw_printenv -n wlanpass)" > /tmp/wpa_supplicant.conf
+    pre-up sed -i 's/#psk.*/scan_ssid=1/g' /tmp/wpa_supplicant.conf
+    pre-up wpa_supplicant -B -i wlan0 -D nl80211,wext -c /tmp/wpa_supplicant.conf
+    post-up echo "nameserver 1.1.1.1" > /etc/resolv.conf
+    post-down killall -q wpa_supplicant

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/etc/wfb.yaml

@@ -0,0 +1,17 @@
+wireless:
+  txpower: 10
+  channel: 161
+  width: 20
+  mlink: 1500
+broadcast:
+  mcs_index: 2
+  tun_index: 1
+  fec_k: 8
+  fec_n: 12
+  stbc: 0
+  ldpc: 0
+  link_id: 7669206
+telemetry:
+  router: msposd
+  serial: ttyS2
+  osd_fps: 20

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/usr/bin/channels.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+CHANNEL="${1:-}"
+VALUE="${2:-}"
+
+[ "$CHANNEL" = "6" ] || exit 0
+
+case "$VALUE" in
+    ''|*[!0-9]*) exit 2 ;;
+esac
+
+if [ "$VALUE" -le 1250 ]; then
+    logger -t channels "AUX2=$VALUE -> management"
+    exec /usr/bin/link-mode management
+fi
+
+if [ "$VALUE" -ge 1350 ]; then
+    logger -t channels "AUX2=$VALUE -> preflight"
+    exec /usr/bin/link-mode preflight
+fi
+
+exit 0

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/usr/bin/link-mode

@@ -0,0 +1,65 @@
+#!/bin/sh
+
+LOCK=/run/link-mode.lock
+STATE=/run/link-mode.state
+
+log() {
+    logger -t link-mode "$*"
+}
+
+if ! mkdir "$LOCK" 2>/dev/null; then
+    log "another transition is in progress; ignoring ${1:-}"
+    exit 0
+fi
+
+cleanup() {
+    rmdir "$LOCK" 2>/dev/null || true
+}
+
+trap cleanup EXIT HUP INT TERM
+
+wfb_active() {
+    pidof wfb_tx wfb_rx wfb_tun wifilink >/dev/null
+}
+
+case "${1:-}" in
+    preflight)
+        if wfb_active; then
+            echo wfb >"$STATE"
+            exit 0
+        fi
+
+        log "management -> WFB"
+        ifdown wlan0 >/dev/null 2>&1 || true
+        killall -q wpa_supplicant 2>/dev/null || true
+        ip link set wlan0 up
+
+        if /usr/bin/wifibroadcast start && wfb_active; then
+            echo wfb >"$STATE"
+            log "WFB is active"
+            exit 0
+        fi
+
+        log "WFB start failed"
+        exit 1
+        ;;
+
+    management)
+        if wfb_active; then
+            log "WFB -> management"
+            /usr/bin/wifibroadcast stop
+            killall -q wifilink 2>/dev/null || true
+        fi
+
+        /usr/bin/mgmt-net --force
+        echo management >"$STATE"
+        log "management path restored"
+        /etc/init.d/S97link-monitor start
+        exit 0
+        ;;
+
+    *)
+        echo "Usage: $0 {preflight|management}" >&2
+        exit 2
+        ;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/usr/bin/mgmt-net

@@ -0,0 +1,59 @@
+#!/bin/sh
+
+STATE=/run/mgmt-net.state
+LINK_LOCK=/run/link-mode.lock
+FORCE="${1:-}"
+
+[ -e "$LINK_LOCK" ] && [ "$FORCE" != "--force" ] && exit 0
+
+eth_standby() {
+    ifdown eth0 2>/dev/null || true
+    ifup eth0
+    ip addr flush dev eth0
+}
+
+carrier=0
+if [ -r /sys/class/net/eth0/carrier ]; then
+    carrier=$(cat /sys/class/net/eth0/carrier 2>/dev/null || echo 0)
+fi
+
+if pidof wfb_tx wfb_rx wfb_tun wifilink >/dev/null; then
+    wfb_active=1
+else
+    wfb_active=0
+fi
+
+if [ "$carrier" = "1" ]; then
+    wanted=ethernet
+elif [ "$wfb_active" = "1" ]; then
+    wanted=wfb
+else
+    wanted=wifi
+fi
+
+current=$(cat "$STATE" 2>/dev/null || true)
+[ "$wanted" = "$current" ] && [ "$FORCE" != "--force" ] && exit 0
+
+case "$wanted" in
+    ethernet)
+        [ "$wfb_active" = "0" ] && ifdown wlan0 2>/dev/null || true
+        ifdown eth0 2>/dev/null || true
+        ifup eth0
+        ;;
+
+    wifi)
+        eth_standby
+        ifdown wlan0 2>/dev/null || true
+        ip link set wlan0 down
+        iw dev wlan0 set type managed
+        ip link set wlan0 up
+        ifup wlan0
+        ;;
+
+    wfb)
+        eth_standby
+        ;;
+esac
+
+echo "$wanted" >"$STATE"
+logger -t mgmt-net "active path: $wanted"

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/usr/bin/wifibroadcast

@@ -0,0 +1,196 @@
+#!/bin/sh
+wfb_key=/etc/drone.key
+wfb_cfg=/etc/wfb.yaml
+wfb_dev=wlan0
+
+echo_log() {
+	echo "$1" | logger -s -t wifibroadcast
+}
+
+wfb_yaml() {
+	if [ -e "$1" ]; then
+		while IFS=: read -r key value; do
+			key=$(eval echo "$key")
+			value=$(eval echo "$value")
+			export "$key=$value"
+		done < "$1"
+	fi
+}
+
+load_config() {
+	wfb_yaml /rom"$wfb_cfg"
+	wfb_yaml "$wfb_cfg"
+	[ ! -e "$wfb_key" ] && wfb_key=/rom"$wfb_key"
+}
+
+load_modules() {
+	for card in $(lsusb | awk '{print $6}' | uniq); do
+		case "$card" in
+			"0bda:8812" | "0bda:881a" | "0b05:17d2" | "2357:0101" | "2604:0012")
+				driver=88XXau
+				;;
+
+			"0bda:a81a")
+				driver=8812eu
+				;;
+
+			"0bda:f72b" | "0bda:b733")
+				driver=8733bu
+				;;
+		esac
+	done
+
+	if [ -z "$driver" ]; then
+		echo_log "Wireless module not detected!"
+		exit 1
+	fi
+
+	echo_log "Detected driver: $driver"
+	[ -e /sys/class/net/"$wfb_dev" ] && return
+	sleep 1
+
+	if [ "$driver" != "88XXau" ]; then
+		opt1="rtw_tx_pwr_by_rate=0"
+		opt2="rtw_tx_pwr_lmt_enable=0"
+	fi
+
+	modprobe "$driver" "$opt1" "$opt2"
+	sleep 3
+
+	if ! ifconfig "$wfb_dev" up; then
+		echo_log "Wireless driver not found!"
+		exit 1
+	fi
+}
+
+load_mlink() {
+	ifconfig "$wfb_dev" mtu "$mlink"
+
+	nalu=$((mlink - 100))
+	if [ "$(cli -g .outgoing.naluSize)" != "$nalu" ]; then
+		cli -s .outgoing.naluSize "$nalu"
+		killall -1 majestic
+	fi
+}
+
+load_interface() {
+	iw "$wfb_dev" set monitor none
+
+	[ "$width" = "40" ] && wfb_width=HT40+ || wfb_width=HT20
+	iw "$wfb_dev" set channel "$channel" "$wfb_width"
+	iw reg set 00
+
+	[ "$driver" = "88XXau" ] && wfb_power=$((txpower * -100)) || wfb_power=$((txpower * 50))
+	iw "$wfb_dev" set txpower fixed "$wfb_power"
+}
+
+load_wfb() {
+	wfb_rx -K "$wfb_key" -i "$link_id" -p "$1" -u "$3" "$wfb_dev" &> /dev/null &
+	wfb_tx -K "$wfb_key" -M "$tun_index" -B "$width" -k "$fec_k" -n "$fec_n" \
+		-S "$stbc" -L "$ldpc" -i "$link_id" -p "$2" -u "$4" "$wfb_dev" &> /dev/null &
+}
+
+start_broadcast() {
+	echo_log "Starting wfb_tx"
+	wfb_tx -K "$wfb_key" -M "$mcs_index" -B "$width" -k "$fec_k" -n "$fec_n" -U rtp_local \
+		-S "$stbc" -L "$ldpc" -i "$link_id" -C 8000 "$wfb_dev" &> /dev/null &
+}
+
+start_tunnel() {
+	echo_log "Starting wfb_tun"
+	load_wfb 160 32 5800 5801
+	wfb_tun -a 10.5.0.10/24 > /dev/null &
+}
+
+start_telemetry() {
+	chipset=$(ipcinfo -c)
+	[ "$chipset" = "ssc33x" ] && devmem 0x1F207890 16 0x8
+
+	port_rx=14550
+	port_tx=14551
+
+	echo_log "Starting $router"
+	load_wfb 144 16 "$port_rx" "$port_tx"
+
+	if [ "$router" = "mavfwd" ]; then
+		mavfwd -b 115200 -c 8 -p 100 -a 15 -t -m /dev/"$serial" \
+			-o 127.0.0.1:"$port_tx" -i 127.0.0.1:"$port_rx" > /dev/null &
+	else
+		if [ "$router" = "msposd" ]; then
+			size=$(curl -s localhost/api/v1/config.json | jsonfilter -qe "@.video0.size")
+		fi
+        if ! pidof msposd >/dev/null; then
+		msposd -b 115200 -c 8 -c 6 -p 500 -w 1000 -r "$osd_fps" -m /dev/"$serial" \
+			-o 127.0.0.1:"$port_tx" -z "$size" > /dev/null &
+        fi
+	fi
+}
+
+video_settings() {
+	sensor=$(ipcinfo -s)
+	cli -s .isp.sensorConfig /etc/sensors/"$sensor"_fpv.bin
+	cli -s .isp.exposure 5
+	cli -s .video0.fps 60
+	cli -s .video0.size 1280x720
+	cli -s .video0.bitrate 4096
+	cli -s .video0.codec h264
+	cli -s .video0.rcMode cbr
+	cli -s .video0.gopSize 0.2
+	cli -s .outgoing.enabled true
+	cli -s .outgoing.wfb true
+	cli -s .fpv.enabled true
+	cli -s .fpv.noiseLevel 1
+	cli -s .records.split 1
+	cli -s .records.notime true
+}
+
+start() {
+	load_config
+	load_modules
+	load_mlink
+	load_interface
+
+	if [ ! -e /etc/system.ok ]; then
+		video_settings
+		touch /etc/system.ok
+#		killall -1 majestic
+		reboot
+	fi
+
+	stop
+	start_broadcast
+	start_tunnel
+	start_telemetry
+	wifilink 20 &
+}
+
+stop() {
+	for process in wfb_rx wfb_tx wfb_tun mavfwd; do
+		if [ -n "$(pidof $process)" ]; then
+			echo_log "Stopping $process"
+			killall -q "$process"
+		fi
+	done
+}
+
+case "$1" in
+	start|stop)
+		$1
+		;;
+
+	reset)
+		cp -f /rom"$wfb_cfg" "$wfb_cfg"
+		cp -f /rom/etc/majestic.yaml /etc/majestic.yaml
+		video_settings
+		;;
+
+	cli)
+		shift
+		yaml-cli -i "$wfb_cfg" "$@"
+		;;
+
+	*)
+		echo "Usage: $0 {start|stop|reset|cli}"
+		exit 1
+		;;
+esac

devices/ssc338q_fpv_openipc-urllc-aio/general/overlay/usr/share/openipc/customizer.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Set custom upgrade url
-fw_setenv upgrade 'https://github.com/OpenIPC/builder/releases/download/latest/ssc338q_fpv_openipc-urllc-aio-nor.tgz'
+# Set the reproducible Piksar HiLink firmware release channel.
+fw_setenv upgrade 'https://git.piksar.eu/piotr/openipc-builder/releases/download/latest/ssc338q_fpv_openipc-urllc-aio-nor.tgz'
 
 exit 0

devices/ssc338q_fpv_openipc-urllc-aio/general/scripts/excludes/ssc338q_fpv.list

@@ -14,3 +14,8 @@
 /lib/modules/4.9.84/sigmastar/sensor_os04c10_mipi.ko
 /lib/modules/4.9.84/sigmastar/sensor_sc501ai_mipi.ko
 /lib/modules/4.9.84/sigmastar/sensor_sc8235_mipi.ko
+#
+# HiLink's radio is USB 0bda:a81a and loads 8812eu. The legacy 88XXau
+# module targets other adapters and is 1.4 MiB, which exceeds the 8 MiB
+# rootfs budget without serving this fixed hardware profile.
+/lib/modules/4.9.84/extra/88XXau.ko