Add TP-Link Kasa KC110 (HI3518EV200 + OV2735)

[moontwister]

Summary

Adds a new device variant for the TP-Link Kasa KC110 pan-tilt IP camera.

Re-files OpenIPC/firmware#2151 here per @widgetii's review, which correctly pointed out that single-model board packages belong in builder (per-board defconfigs, no impact on the firmware-repo CI matrix, no BR2_PACKAGE_GPIO_MOTORS path collisions).

Hardware

SoC	Hi3518EV200 (cv200 family)
Sensor	OV2735 (MIPI 1-lane, RAW10)
Wi-Fi	RTL8188FU (USB-attached Realtek 802.11n)
Flash	Winbond W25Q128 (16 MB NOR SPI)
PTZ	4-phase unipolar 24BYJ48 steppers via ULN2803 darlington array
IR-cut	Bipolar coil solenoid; we drive a single master GPIO
IR-LED	Plain GPIO, not PWM

GPIO map (verified on hardware, OpenIPC PL061 numbering):

• Pan motor coils: 65 / 60 / 59 / 58
• Tilt motor coils: 0 / 1 / 2 / 36 (NB: vendor's "44" is bank 4 pin 4 = pin 36 in PL061's standard numbering, not 44)
• IR-cut: 64 (vendor base-10 GPIO 80)
• IR-LED: 63 (vendor base-10 GPIO 77)

What's in this PR

New device: devices/hi3518ev200_ultimate_tplink-kasa-kc110/

• Defconfig — selects BR2_PACKAGE_KC110_BOARD_SUPPORT=y and BR2_PACKAGE_RTL8188FU_OPENIPC=y (no BR2_PACKAGE_GPIO_MOTORS — replaced by our package).
• Excludes list — strips unused sensor .ini / libsns_*.so (keeps OV2735).
• Overlay:
  • etc/sensors/ov2735_i2c_1080p.ini — input_mode = 0 (MIPI; upstream cv200 osdrv has input_mode = 4 which is wrong for OV2735), 1-lane.
  • usr/bin/load_hisilicon — adds ov2735 case that mirrors ov2710_mipi (same MIPI pinmux + clock; sensor differentiation in libsns).
  • usr/share/openipc/customizer.sh — sets RTL8188FU wlandev, sensor config path, IR-cut pin 64, backlight pin 63, lightMonitor: true (for AE recovery after IR-cut toggle in daylight).

New shared package: package/kc110-board-support/

• ptz — C binary, mmap'd PL061 GPIODATA pages, full-step drive with phase continuity, state persisted to /etc/ptz_state. CLI: ptz pan ±N, ptz tilt ±N, ptz home, ptz ir on|off, ptz daynight, ptz status.
• gpio-motors — small shell shim that forwards web-GUI calls (gpio-motors X Y N) to ptz. Drop-in replacement for the upstream BR2_PACKAGE_GPIO_MOTORS binary, which uses sysfs + base-10 pin numbers that don't match this hardware.
• ir-control.sh — convenience wrapper for IR-LED + IR-cut.
• S94pinmux-pan-ir — boot-time pinmux init. Writes 0x1 to pinmux registers 0x200f00e8/ec/f0/fc/100/104 (pads 58-64 in chip7/8 region). The OpenIPC kernel pinctrl driver doesn't auto-set these for KC110's pan motor / IR-cut / IR-LED pads — vendor firmware writes them explicitly in hn_config.sh. Without this fix, PL061 GPIODATA writes succeed silently but the pads never drive the ULN2803 / solenoid / LED, which looks indistinguishable from a hardware fault.

Status

Feature	Working?
Pan motor	✅
Tilt motor	✅
IR-cut filter	✅
IR-LED	✅
Wi-Fi (RTL8188FU)	✅
RTSP + HTTP + JPEG (video)	⚠️ requires downstream LD_PRELOAD shim around HI_MIPI_SET_DEV_ATTR

The shim works around upstream majestic building combo_dev_attr_t with enIntfMode=DC and raw_data_type=0 for MIPI sensors that need RAW10. The shim is intentionally not included in this PR per the review feedback on #2151 that LD_PRELOAD wrappers don't belong in the OpenIPC tree. The proper fix lives in majestic; once landed upstream, this builder image produces a fully-functional KC110 binary with no further changes.

Test plan

• Hardware: TP-Link Kasa KC110, serial console + UART rescue path verified, mtd5/mtd6 (vendor mini-kernel rescue) preserved.
• PTZ motors: pan/tilt full range + soft endstops verified on bench (1934 steps over 170° pan, 387 steps over ~68° tilt).
• IR-cut + IR-LED: visible solenoid click on transition, visible IR-LED glow.
• Web-GUI motor block: motor.cgi press-and-hold drives ptz via gpio-motors shim.
• Wi-Fi: RTL8188FU auto-up via fw_setenv wlandev rtl8188fu-generic.
• Sensor i2c: chip ID 0x27 / 0x35 reads back correctly.
• MIPI receiver: with downstream shim, /proc/driver/hi_mipi shows LaneNum=2 RAW10 MIPI, mean RGB ~122/129/141 (proper exposure), 10 fps H.264 1080p stable.

cc @widgetii — re-targeted at builder per your review on OpenIPC/firmware#2151. Happy to address review feedback.

🤖 Generated with Claude Code