diff --git a/devices/baicells_qafa.py b/devices/baicells_qafa.py
new file mode 100644
index 0000000..e30a59b
--- /dev/null
+++ b/devices/baicells_qafa.py
@@ -0,0 +1,271 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.baicells_qafb import (
+    BaicellsQafbGetObjectParametersState,
+    BaicellsQafbWaitGetTransientParametersState,
+)
+from devices.device_utils import EnodebDeviceName
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AddObjectsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetParametersState,
+    GetRPCMethodsState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+
+
+class BaicellsQAFAHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+        self,
+        service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='get_rpc_methods'),
+            'get_rpc_methods': GetRPCMethodsState(self, when_done='wait_empty', when_skip='get_transient_params'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': BaicellsQafbWaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': BaicellsQafbGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='check_get_params'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            # These states are only entered through manual user intervention
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_empty', when_timeout='wait_inform'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS_QAFA
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsQAFATrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsQAFATrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class BaicellsQAFATrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098.
+    This class is effectively read-only.
+
+    This model specifically targets Qualcomm-based BaiCells units running
+    QAFA firmware.
+
+    These models have these idiosyncrasies (on account of running TR098):
+
+    - Parameter content root is different (InternetGatewayDevice)
+    - GetParameter queries with a wildcard e.g. InternetGatewayDevice. do
+      not respond with the full tree (we have to query all parameters)
+    - MME status is not exposed - we assume the MME is connected if
+      the eNodeB is transmitting (OpState=true)
+    - Parameters such as band capability/duplex config
+      are rooted under `boardconf.` and not the device config root
+    - Parameters like Admin state, CellReservedForOperatorUse,
+      Duplex mode, DL bandwidth and Band capability have different
+      formats from Intel-based Baicells units, necessitating,
+      formatting before configuration and transforming values
+      read from eNodeB state.
+    - Num PLMNs is not reported by these units
+    """
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'InternetGatewayDevice.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    EEPROM_PATH = 'boardconf.status.eepromInfo.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Qualcomm units do not expose MME_Status (We assume that the eNB is broadcasting state is connected to the MME)
+        ParameterName.MME_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.latitude', True, TrParameterType.STRING, False),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.longitude', True, TrParameterType.STRING, False),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(EEPROM_PATH + 'div_multiple', True, TrParameterType.STRING, False),
+        ParameterName.BAND_CAPABILITY: TrParam(EEPROM_PATH + 'work_mode', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.EARFCNDL', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', True, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(DEVICE_PATH + 'Services.RfConfig.1.RfCarrierCommon.carrierBwMhz', True, TrParameterType.INT, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, 'bool', False),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.STRING, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        # This parameter is standard but doesn't exist
+        # ParameterName.NUM_PLMNS: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False),
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam('boardconf.ipsec.ipsecConfig.onBoot', False, TrParameterType.BOOLEAN, False),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.Enable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.PeriodicUploadInterval', False, TrParameterType.INT, False),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.URL', False, TrParameterType.STRING, False),
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.CELL_BARRED: transform_for_enb.invert_cell_barred,
+    }
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        TRANSFORMS_FOR_ENB[ParameterName.PLMN_N_CELL_RESERVED % i] = transform_for_enb.cell_reserved
+        PARAMETERS[ParameterName.PLMN_N % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False)
+
+    TRANSFORMS_FOR_ENB[ParameterName.ADMIN_STATE] = transform_for_enb.admin_state
+    TRANSFORMS_FOR_MAGMA = {
+        # We don't set these parameters
+        ParameterName.BAND_CAPABILITY: transform_for_magma.band_capability,
+        ParameterName.DUPLEX_MODE_CAPABILITY: transform_for_magma.duplex_mode,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        """
+        Load all the parameters instead of a subset.
+        """
+        return list(cls.PARAMETERS.keys())
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(
+        cls,
+    ) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+
+        return names
+
+
+class BaicellsQAFATrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+
+        desired_cfg.delete_parameter(ParameterName.ADMIN_STATE)