ipq40xx: add support for Sony NCP-HG100/Cellular

Sony NCP-HG100/Cellular is a IoT Gateway with 2.4/5 GHz band 11ac
(WiFi-5) wireless function, based on IPQ4019.

Specification:

- SoC                   : Qualcomm IPQ4019
- RAM                   : DDR3 512 MiB (H5TC4G63EFR)
- Flash                 : eMMC 4 GiB (THGBMNG5D1LBAIT)
- WLAN                  : 2.4/5 GHz 2T2R (IPQ4019)
- Ethernet              : 10/100/1000 Mbps x2
  - Transceiver         : Qualcomm QCA8072
- WWAN                  : Telit LN940A9
- Z-Wave                : Silicon Labs ZM5101
- Bluetooth             : Qualcomm CSR8811
- Audio DAC             : Realtek ALC5629
- Audio Amp.            : Realtek ALC1304
- Voice Input Processor : Conexant CX20924
- Micro Controller Unit : Nuvoton MINI54FDE
  - RGB LED, Fan, Temp. sensors
- Touch Sensor          : Cypress CY8C4014LQI
- RGB LED driver        : TI LP55231 (2x)
- LEDs/Keys             : 11x, 6x
- UART                  : through-hole on PCB
  - J1: 3.3V, TX, RX, GND from tri-angle marking
  - 115200n8
- Power                 : 12 VDC, 2.5 A

Flash instruction using initramfs image:

1. Prepare TFTP server with the IP address 192.168.132.100 and place the
   initramfs image to TFTP directory with the name "C0A88401.img"

2. Boot NCP-HG100/Cellular and interrupt after the message
   "Hit any key to stop autoboot:  2"

3. Perform the following commands and set bootcmd to allow booting from
   eMMC

   setenv bootcmd "mmc read 0x84000000 0x2e22 0x4000 && bootm 0x84000000"
   saveenv

4. Perform the following command to load/boot the OpenWrt initramfs image

   tftpboot && bootm

5. On the initramfs image, perform sysupgrade with the sysupgrade image
   (if needed, backup eMMC partitions by dd command and download to
   other place before performing sysupgrade)

6. Wait for ~120 seconds to complete flashing

Known issues:

- There are no drivers for audio-related chips/functions in Linux Kernel
  and OpenWrt, they cannot be used.

- There is no driver for MINI54FDE Micro-Controller Unit, customized for
  this device by the firmware in the MCU. This chip controls the
  following functions, but they cannot be controlled in OpenWrt.

  - RGB LED
  - Fan
    this fan is controlled automatically by MCU by default, without
    driver
  - Thermal Sensors (2x)

- Currently, there is no driver or tool for CY8C4014LQI and cannot be
  controlled. It cannot be exited from "booting mode" and moved to "normal
  op mode" after booting. And also, the 4x buttons (mic mute, vol down,
  vol up, alexa trigger) connected to the IC cannot be controlled.

  - it can be exited from "booting mode" by installing and executing
    i2cset command:

    opkg update
    opkg install i2c-tools
    i2cset -y 1 0x14 0xf 1

- There is a connection issue on the control by uqmi for the WWAN module.
  But modemmanager can be used without any issues and the use of it is
  recommended.

- With the F2FS format, too many errors are reported on erasing eMMC
  partition "rootfs_data" while booting:

  [    1.360270] sdhci: Secure Digital Host Controller Interface driver
  [    1.363636] sdhci: Copyright(c) Pierre Ossman
  [    1.369730] sdhci-pltfm: SDHCI platform and OF driver helper
  [    1.374729] sdhci_msm 7824900.sdhci: Got CD GPIO
  ...
  [    1.413552] mmc0: SDHCI controller on 7824900.sdhci [7824900.sdhci] using ADMA 64-bit
  [    1.528325] mmc0: new HS200 MMC card at address 0001
  [    1.530627] mmcblk0: mmc0:0001 004GA0 3.69 GiB
  [    1.533530] mmcblk0boot0: mmc0:0001 004GA0 partition 1 2.00 MiB
  [    1.537831] mmcblk0boot1: mmc0:0001 004GA0 partition 2 2.00 MiB
  [    1.542918] mmcblk0rpmb: mmc0:0001 004GA0 partition 3 512 KiB, chardev (247:0)
  [    1.550323] Alternate GPT is invalid, using primary GPT.
  [    1.561669]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17
  ...
  [    8.841400] mount_root: loading kmods from internal overlay
  [    8.860241] kmodloader: loading kernel modules from //etc/modules-boot.d/*
  [    8.863746] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
  [    9.240465] block: attempting to load /etc/config/fstab
  [    9.246722] block: unable to load configuration (fstab: Entry not found)
  [    9.246863] block: no usable configuration
  [    9.254883] mount_root: overlay filesystem in /dev/mmcblk0p17 has not been formatted yet
  [    9.438915] urandom_read: 5 callbacks suppressed
  [    9.438924] random: mkfs.f2fs: uninitialized urandom read (16 bytes read)
  [   12.243332] mmc_erase: erase error -110, status 0x800
  [   12.246638] mmc0: cache flush error -110
  [   15.134585] mmc_erase: erase error -110, status 0x800
  [   15.135891] mmc_erase: group start error -110, status 0x0
  [   15.139850] mmc_erase: group start error -110, status 0x0
  ...(too many the same errors)...
  [   17.350811] mmc_erase: group start error -110, status 0x0
  [   17.356197] mmc_erase: group start error -110, status 0x0
  [   17.439498] sdhci_msm 7824900.sdhci: Card stuck in wrong state! card_busy_detect status: 0xe00
  [   17.446910] mmc0: tuning execution failed: -5
  [   17.447111] mmc0: cache flush error -110
  [   18.012440] F2FS-fs (mmcblk0p17): Found nat_bits in checkpoint
  [   18.062652] F2FS-fs (mmcblk0p17): Mounted with checkpoint version = 428fa16b
  [   18.198691] block: attempting to load /etc/config/fstab
  [   18.198972] block: unable to load configuration (fstab: Entry not found)
  [   18.203029] block: no usable configuration
  [   18.211371] mount_root: overlay filesystem has not been fully initialized yet
  [   18.214487] mount_root: switching to f2fs overlay

  So, this support uses ext4 format instead which has no errors.

Note:

- The primary uart is shared for debug console and Z-Wave chip. The
  function is switched by GPIO15 (Linux: 427).

  value:

    1: debug console
    0: Z-Wave

- NCP-HG100/Cellular has 2x os-image pairs in eMMC.

  - 0:HLOS, rootfs
  - 0:HLOS_1, rootfs_1

  In OpenWrt, the first image pair is used.

- "bootipq" command in U-Boot requires authentication with signed-image
  by default. To boot unsigned image of OpenWrt, use "mmc read" and
  "bootm" command instead.

- This support is for "Cellular" variant of NCP-HG100 and not tested on
  "WLAN" (non-cellular) variant.

- The board files of ipq-wifi may also be used in "WLAN" variant of
  NCP-HG100, but unconfirmed and add files as for "Cellular" variant.

- "NET" LED is used to indicate WWAN status in stock firmware.

- There is no MAC address information in the label on the case, use the
  address included in UUID in the label as "label-MAC" instead.

- The "CLOUD" LEDs are partially used for indication of system status in
  stock firmware, use they as status LEDs in OpenWrt instead of RGB LED
  connected to the MCU.

MAC addresses:

LAN    : 5C:FF:35:**:**:ED (ART, 0x6    (hex))
WAN    : 5C:FF:35:**:**:EF (ART, 0x0    (hex))
2.4 GHz: 5C:FF:35:**:**:ED (ART, 0x1006 (hex))
5 GHz  : 5C:FF:35:**:**:EE (ART, 0x5006 (hex))

partition layout in eMMC (by fdisk, GPT):

Disk /dev/mmcblk0: 7733248 sectors, 3776M
Logical sector size: 512
Disk identifier (GUID): ****
Partition table holds up to 20 entries
First usable sector is 34, last usable sector is 7634910

Number  Start (sector)    End (sector)  Size Name
     1              34            1057  512K 0:SBL1
     2            1058            2081  512K 0:BOOTCONFIG
     3            2082            3105  512K 0:QSEE
     4            3106            4129  512K 0:QSEE_1
     5            4130            4641  256K 0:CDT
     6            4642            5153  256K 0:CDT_1
     7            5154            6177  512K 0:BOOTCONFIG1
     8            6178            6689  256K 0:APPSBLENV
     9            6690            8737 1024K 0:APPSBL
    10            8738           10785 1024K 0:APPSBL_1
    11           10786           11297  256K 0:ART
    12           11298           11809  256K 0:HSEE
    13           11810           28193 8192K 0:HLOS
    14           28194           44577 8192K 0:HLOS_1
    15           44578          306721  128M rootfs
    16          306722          568865  128M rootfs_1
    17          568866         3958065 1654M rootfs_data

[initial work]
Signed-off-by: Iwao Yuki <dev.clef@gmail.com>
Co-developed-by: Iwao Yuki <dev.clef@gmail.com>
[adjustments, cleanups, commit message, sending patch]
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
(dropped clk_unused_ignore, dropped 901-* patches, renamed
key nodes, changed LEDs chan/labels to match func-en, made
:net -> (w)wan leds)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>

10 files changed, 756 insertions, 1 deletions

diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
index 7b683ef0a2..e76aa9235e 100644
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -37,6 +37,7 @@ ALLWIFIBOARDS:= \
 	pakedge_wr-1 \
 	qxwlan_e2600ac-c1 \
 	qxwlan_e2600ac-c2 \
+	sony_ncp-hg100-cellular \
 	teltonika_rutx
 
 ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
@@ -110,6 +111,7 @@ $(eval $(call generate-ipq-wifi-package,p2w_r619ac,P&W R619AC))
 $(eval $(call generate-ipq-wifi-package,pakedge_wr-1,Pakedge WR-1))
 $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c1,Qxwlan E2600AC C1))
 $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac-c2,Qxwlan E2600AC C2))
+$(eval $(call generate-ipq-wifi-package,sony_ncp-hg100-cellular,Sony NCP-HG100/Cellular))
 $(eval $(call generate-ipq-wifi-package,teltonika_rutx,Teltonika RUTX))
 
 $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
diff --git a/package/firmware/ipq-wifi/board-sony_ncp-hg100-cellular.qca4019 b/package/firmware/ipq-wifi/board-sony_ncp-hg100-cellular.qca4019
new file mode 100644
index 0000000000..6776864de7
--- /dev/null
+++ b/package/firmware/ipq-wifi/board-sony_ncp-hg100-cellular.qca4019
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index 0e473534f5..4b9522af92 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -94,6 +94,11 @@ qxwlan,e2600ac-c2)
 	ucidef_set_led_wlan "wlan2g" "WLAN0" "green:wlan0" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WLAN1" "green:wlan1" "phy1tpt"
 	;;
+sony,ncp-hg100-cellular)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth0"
+	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_netdev "wwan" "WWAN" "green:wan-4" "wwan0"
+	;;
 zyxel,nbg6617 |\
 zyxel,wre6606)
 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy0tpt"
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 040f3ee619..74a1d61d06 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -19,7 +19,8 @@ ipq40xx_setup_interfaces()
 	luma,wrtq-329acn|\
 	netgear,wac510|\
 	plasmacloud,pa1200|\
-	plasmacloud,pa2200)
+	plasmacloud,pa2200|\
+	sony,ncp-hg100-cellular)
 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
 		;;
 	aruba,ap-303|\
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
index a52a33d2f4..2ead17b152 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
@@ -24,6 +24,9 @@ mikrotik,cap-ac)
 mikrotik,hap-ac3)
 	ucidef_add_gpio_switch "poe_passtrough" "PoE Passthrough" "452" "0"
 	;;
+sony,ncp-hg100-cellular)
+	ucidef_add_gpio_switch "uart_dbgcon_en" "debug console enable" "427" "1"
+	;;
 zte,mf286d)
 	ucidef_add_gpio_switch "power_btn_block" "Power button blocker" "421" "0"
 	;;
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 6adf6f23f1..f8d270a659 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -142,6 +142,9 @@ case "$FIRMWARE" in
 		caldata_extract "0:ART" 0x1000 0x2f20
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary "0:CONFIG" 0x0) 2)
 		;;
+	sony,ncp-hg100-cellular)
+		caldata_extract_mmc "0:ART" 0x1000 0x2f20
+		;;
 	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		caldata_extract "ART" 0x1000 0x2f20
@@ -237,6 +240,9 @@ case "$FIRMWARE" in
 		caldata_extract "0:ART" 0x5000 0x2f20
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary "0:CONFIG" 0x0) 3)
 		;;
+	sony,ncp-hg100-cellular)
+		caldata_extract_mmc "0:ART" 0x5000 0x2f20
+		;;
 	zyxel,nbg6617 |\
 	zyxel,wre6606)
 		caldata_extract "ART" 0x5000 0x2f20
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index 0fa30db7cf..8a45bb213c 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -194,6 +194,9 @@ platform_do_upgrade() {
 		PART_NAME="inactive"
 		platform_do_upgrade_dualboot_datachk "$1"
 		;;
+	sony,ncp-hg100-cellular)
+		sony_emmc_do_upgrade "$1"
+		;;
 	teltonika,rutx10 |\
 	zte,mf286d)
 		CI_UBIPART="rootfs"
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh b/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh
new file mode 100644
index 0000000000..8ff9df0fac
--- /dev/null
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/sony.sh
@@ -0,0 +1,91 @@
+. /lib/functions.sh
+
+update_bootconfig() {
+	local offset=$1
+	local index="$2"
+	local cfgpart=$(find_mmc_part "0:BOOTCONFIG")
+	local cur_index
+
+	if [ -z "$cfgpart" ]; then
+		echo "failed to get the partition: \"0:BOOTCONFIG\""
+		return 1
+	fi
+
+	cur_index=$(dd if=${cfgpart} bs=1 count=1 skip=$offset 2> /dev/null | hexdump -e '"%d"')
+	if [ ${index} != ${cur_index} ]; then
+		echo "updating \"0:BOOTCONFIG\""
+		echo -en "\x0${index}" | \
+			dd of=${cfgpart} bs=1 count=1 seek=$offset conv=notrunc 2>/dev/null
+	fi
+
+	# also update 0:BOOTCONFIG1 if exists
+	cfgpart=$(find_mmc_part "0:BOOTCONFIG1")
+	[ -z "$cfgpart" ] && return
+
+	cur_index=$(dd if=${cfgpart} bs=1 count=1 skip=$offset 2> /dev/null | hexdump -e '"%d"')
+	if [ ${index} != ${cur_index} ]; then
+		echo "updating \"0:BOOTCONFIG1\""
+		echo -en "\x0${index}" | \
+			dd of=${cfgpart} bs=1 count=1 seek=$offset conv=notrunc 2>/dev/null
+	fi
+}
+
+### Note ###
+# After the commit bad1835f27ec31dbc30060b03cc714212275168a in fstools,
+# p17 (label: "rootfs_data") is mounted as a rootfs_data on boot instead
+# of the loop device labeled as "rootfs_data" in p15 (label: "rootfs").
+#
+# cmdline flag is added to avoid mount "rootfs_data" partition by the
+# commit 964d1e3af0e111bad6d393f8a3be702e334c2398 in fstools, but
+# NCP-HG100 doesn't use it because it has a large (abount 1.6GB)
+# "rootfs_data" partition and the advantage is larger than the
+# disadvantages, such as overwriting the stock data in "rootfs_data"
+# partition.
+sony_emmc_do_upgrade() {
+	local tar_file=$1
+	local kernel_dev
+	local rootfs_dev
+	local board_dir
+
+	kernel_dev=$(find_mmc_part "0:HLOS")
+	rootfs_dev=$(find_mmc_part "rootfs")
+	rootfs_data_dev=$(find_mmc_part "rootfs_data")
+
+	if [ -z "$kernel_dev" ] || [ -z "$rootfs_dev" ] || [ -z "$rootfs_data_dev" ]; then
+		echo "The partition name for kernel or rootfs or rootfs_data is not specified or failed to get the mmc device."
+		exit 1
+	fi
+
+	# use first partitions of kernel/rootfs for NCP-HG100
+	# - offset  88 (0x58): 0:HLOS (kernel)
+	# - offset 108 (0x6c): rootfs
+	update_bootconfig 88 0 || exit 1
+	update_bootconfig 108 0 || exit 1
+
+	board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
+	board_dir=${board_dir%/}
+
+	echo "Flashing kernel to ${kernel_dev}"
+	tar xf $tar_file ${board_dir}/kernel -O > $kernel_dev
+
+	echo "Flashing rootfs to ${rootfs_dev}"
+	tar xf $tar_file ${board_dir}/root -O > $rootfs_dev
+
+	echo "Format new rootfs_data"
+	mkfs.ext4 -F -L rootfs_data $rootfs_data_dev
+
+	if [ -e "$UPGRADE_BACKUP" ]; then
+		mkdir /tmp/new_root
+		mount -t ext4 $rootfs_data_dev /tmp/new_root && {
+			echo "Saving configurations to rootfs_data"
+			cp "$UPGRADE_BACKUP" "/tmp/new_root/$BACKUP_FILE"
+			umount /tmp/new_root
+		}
+	fi
+
+	echo "sysupgrade successful"
+
+	sync
+	umount -a
+	reboot -f
+}
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts
new file mode 100644
index 0000000000..f1ac5fd52f
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-ncp-hg100-cellular.dts
@@ -0,0 +1,631 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+#include "qcom-ipq4019.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	model = "Sony NCP-HG100/Cellular";
+	compatible = "sony,ncp-hg100-cellular";
+
+	aliases {
+		led-boot = &led_cloud_green;
+		led-failsafe = &led_cloud_red;
+		led-running = &led_cloud_green;
+		led-upgrade = &led_cloud_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyMSM0,115200n8 root=/dev/mmcblk0p15 rootfstype=squashfs,ext4";
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x80000000 0x20000000>;
+	};
+
+	soc {
+		tcsr@1949000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1949000 0x100>;
+			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
+		};
+
+		tcsr@194b000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x194b000 0x100>;
+			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
+		};
+
+		ess_tcsr@1953000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1953000 0x1000>;
+			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
+		};
+
+		tcsr@1957000 {
+			status = "okay";
+			compatible = "qcom,tcsr";
+			reg = <0x1957000 0x100>;
+			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		dma@7984000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+			switch_mac_mode = <0x0>; /* mac mode for RGMII RMII */
+			switch_initvlas = <0x0007c 0x54>; /* PORT0_STATUS */
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+
+	keys-repeat {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&keys_pins>;
+		pinctrl-names = "default";
+		autorepeat;
+
+		key-volup {
+			label = "volume up";
+			linux,code = <KEY_VOLUMEUP>;
+			gpios = <&tlmm 39 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-voldown {
+			label = "volume down";
+			linux,code = <KEY_VOLUMEDOWN>;
+			gpios = <&tlmm 40 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-alexatrigger {
+			label = "alexa trigger";
+			linux,code = <BTN_0>;
+			gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
+			linux,input-type = <EV_KEY>;
+		};
+
+		key-mute {
+			label = "mic mute";
+			linux,code = <BTN_1>;
+			gpios = <&tlmm 47 GPIO_ACTIVE_LOW>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		key-reset {
+			label = "reset";
+			gpios = <&tlmm 2 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		key-wps {
+			label = "setup";
+			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&tlmm {
+	pinctrl-0 = <&bt_pins>, <&aud_pins>, <&mcu_pins>;
+	pinctrl-names = "default";
+
+	/*
+	 * uart0 is shared for debug console and Z-Wave,
+	 * use only for debug console in OpenWrt.
+	 *
+	 * 1: debug console
+	 * 0: Z-Wave
+	 */
+	uart0_ctrl_pins: uart0_ctrl_pinmux {
+		mux {
+			pins = "gpio15";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio16", "gpio17";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	/*
+	 * reset pin for Z-Wave
+	 * active-low, >= 20ns
+	 */
+	zwave_pins: zwave_pinmux {
+		mux {
+			pins = "gpio59";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	serial_1_pins: serial1_pinmux {
+		mux {
+			pins = "gpio8", "gpio9",
+				"gpio10", "gpio11";
+			function = "blsp_uart1";
+			bias-disable;
+		};
+	};
+
+	bt_pins: bt_pinmux {
+		mux_reset {
+			pins = "gpio66";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_pwr {
+			pins = "gpio68";
+			function = "gpio";
+			output-high;
+		};
+	};
+
+	mdio_pins: mdio_pinmux {
+		mux_1 {
+			pins = "gpio6";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_2 {
+			pins = "gpio7";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	i2c_1_pins: i2c_1_pinmux {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "blsp_i2c1";
+			bias-disable;
+		};
+	};
+
+	keys_pins: keys_pinmux {
+		mux_1 {
+			pins = "gpio39", "gpio40", "gpio42", "gpio47";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio2";
+			function = "gpio";
+			input;
+		};
+	};
+
+	sd_pins: sd_pins {
+		mux {
+			function = "sdio";
+			pins = "gpio23", "gpio24", "gpio25", "gpio26",
+				"gpio28", "gpio29", "gpio30", "gpio31";
+			drive-strength = <4>;
+		};
+
+		mux_sd_clk {
+			function = "sdio";
+			pins = "gpio27";
+			drive-strength = <16>;
+		};
+
+		mux_sd7 {
+			function = "sdio";
+			pins = "gpio32";
+			drive-strength = <4>;
+			bias-disable;
+		};
+	};
+
+	aud_pins: aud_pinmux {
+		mux {
+			pins = "gpio48", "gpio49", "gpio50", "gpio51";
+			function = "aud_pin";
+		};
+	};
+
+	alc1304_pins: alc1304_pinmux {
+		mux_1 {
+			pins = "gpio44";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio45";
+			function = "gpio";
+			bias-disable;
+		};
+	};
+
+	cx2902x_reset: cx2902x_pinmux {
+		mux_1 {
+			pins = "gpio64";
+			function = "gpio";
+			bias-disable;
+		};
+
+		mux_2 {
+			pins = "gpio65";
+			function = "gpio";
+			bias-disable;
+		};
+	};
+
+	lte_pins: lte_pinmux {
+		mux_en {
+			pins = "gpio20";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_reset {
+			pins = "gpio35";
+			function = "gpio";
+			input;
+		};
+	};
+
+	usb3_pins: usb3_pinmux {
+		mux_en {
+			pins = "gpio36";
+			function = "gpio";
+			output-high;
+		};
+
+		mux_flt {
+			pins = "gpio4";
+			function = "gpio";
+			input;
+		};
+	};
+
+	mcu_pins: mcu_pinmux {
+		mux_boot {
+			pins = "gpio38";
+			function = "gpio";
+			output-low;
+		};
+
+		mux_reset {
+			pins = "gpio5";
+			function = "gpio";
+			output-high;
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_i2c4 {
+	/*
+	 * There is no driver for the following devices:
+	 * - CY8C4014LQI@14	: Touch-Sensor for buttons on top
+	 * - MINI54FDE@15	: MCU for Fan/RGB LED/Thermal control
+	 * - ALC5629@18		: I2S/PCM Audio DAC
+	 * - CX20924@41		: Voice Input Processor
+	 */
+	pinctrl-0 = <&i2c_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+
+	led-controller@32 {
+		compatible = "ti,lp55231";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <0>;
+		enable-gpio = <&tlmm 1 GPIO_ACTIVE_HIGH>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			chan-name = "green:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x0>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@1 {
+			chan-name = "blue:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x1>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@2 {
+			chan-name = "green:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x2>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@3 {
+			chan-name = "blue:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x3>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@4 {
+			chan-name = "green:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x4>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led@5 {
+			chan-name = "blue:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x5>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+		};
+
+		led@6 {
+			chan-name = "red:wan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x6>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led@7 {
+			chan-name = "red:lan";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x7>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_LAN;
+		};
+
+		led@8 {
+			chan-name = "red:wlan-2";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x8>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <2>;
+		};
+	};
+
+	led-controller@33 {
+		compatible = "ti,lp55231";
+		reg = <0x33>;
+		clock-mode = /bits/ 8 <0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			chan-name = "green:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x0>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			linux,default-trigger = "phy1tpt";
+			function-enumerator = <5>;
+		};
+
+		led@1 {
+			chan-name = "blue:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x1>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <5>;
+		};
+
+		led@2 {
+			chan-name = "green:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x2>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led@3 {
+			chan-name = "blue:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x3>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led_cloud_green: led@4 {
+			chan-name = "green:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x4>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@5 {
+			chan-name = "blue:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x5>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@6 {
+			chan-name = "red:wlan-5";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x6>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <5>;
+		};
+
+		led@7 {
+			chan-name = "red:wan-4";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x7>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN; /* WWAN/LTE/4G */
+			function-enumerator = <4>; /* WWAN/LTE/4G */
+		};
+
+		led_cloud_red: led@8 {
+			chan-name = "red:power";
+			led-cur = /bits/ 8 <50>;
+			max-cur = /bits/ 8 <100>;
+			reg = <0x8>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>, <&uart0_ctrl_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	pinctrl-0 = <&serial_1_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 41 GPIO_ACTIVE_LOW>;
+};
+
+&prng {
+	status = "okay";
+};
+
+&vqmmc {
+	status = "okay";
+};
+
+&sdhci {
+	status = "okay";
+	pinctrl-0 = <&sd_pins>;
+	pinctrl-names = "default";
+	vqmmc-supply = <&vqmmc>;
+	non-removable;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	emmc@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+	};
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+
+	pinctrl-0 = <&usb3_pins>, <&lte_pins>;
+	pinctrl-names = "default";
+
+	dwc3@8a00000 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		device@1 {
+			compatible = "usb1bc7,1900";
+			reg = <1>;
+		};
+	};
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Sony-NCP-HG100-Cellular";
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "Sony-NCP-HG100-Cellular";
+};
+
+&watchdog {
+	status = "okay";
+};
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index dfb235c8d5..43244a914c 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -1004,6 +1004,19 @@ define Device/qxwlan_e2600ac-c2
 endef
 TARGET_DEVICES += qxwlan_e2600ac-c2
 
+define Device/sony_ncp-hg100-cellular
+	$(call Device/FitImage)
+	DEVICE_VENDOR := Sony
+	DEVICE_MODEL := NCP-HG100/Cellular
+	DEVICE_DTS_CONFIG := config@ap.dk04.1-c4
+	SOC := qcom-ipq4019
+	KERNEL_SIZE := 8192k
+	IMAGE_SIZE := 128m
+	DEVICE_PACKAGES := e2fsprogs ipq-wifi-sony_ncp-hg100-cellular \
+		kmod-fs-ext4 uqmi
+endef
+TARGET_DEVICES += sony_ncp-hg100-cellular
+
 define Device/teltonika_rutx10
 	$(call Device/FitImage)
 	$(call Device/UbiFit)