7.9. IPA — the networking datapath accelerator

The IPA (IP Accelerator) is a hardware packet-processing engine that offloads routing/filtering/NAT and per-flow DMA from the CPU. On a phone its main job is the cellular (WWAN/RMNET) datapath; on this Wi-Fi-only e-reader that job is dormant, but the IPA block is still present and firmware-loaded because it also backs the WLAN and USB-tethering offload paths. This page separates what is wired to live hardware from what is carried but idle. Facts from artifacts/boot_a/board.dts and kernel_config.txt.

7.9.1. Hardware

  • qcom,ipa — ipa-base ``0x1e00000`` (size 0x84000) + gsi-base ``0x1e04000`` (size 0x23000); IRQs 0x137, 0x1b0. The GSI (Generic Software Interface) is IPA’s event-ring/DMA front end.

  • qcom,ipa-hw-ver = 0x12 — an IPA v4-generation core; ipa-hw-mode = 0 (normal silicon, not emulation).

  • Firmware: qcom,use-gsi-ipa-fw = "lagoon_ipa_fws" — the IPA/GSI microcode, loaded into the ipa_fw_region@0x8b700000 / ipa_gsi_region carve-outs (Base kernel device tree (the SoC boot contract)).

  • SMMU isolation: three context banks — ipa-smmu-ap-cb (AP), ipa-smmu-wlan-cb (WLAN), ipa-smmu-uc-cb (IPA microcontroller) — each an apps-SMMU stream (Base kernel device tree (the SoC boot contract)).

7.9.2. Datapaths — live vs. dormant

Path

Status

Evidence

Modem / RMNET (WWAN)

dormant

qcom,rmnet-ipa3, qcom,modem-cfg-emb-pipe-flt — the embedded modem pipe-filtering path; the modem is never brought up (no cellular RF, ADSP and CDSP firmware)

WLAN offload (WDI2)

wired to live HW

qcom,ipa-wdi2 + qcom,ipa-wdi2_over_gsi + ipa-smmu-wlan-cb — the WLAN-to-IPA data interface for the active WCN3990 Wi-Fi (Bluetooth / FM controller firmware (WCN3990 “Cherokee”))

USB tethering (RNDIS)

available

CONFIG_RNDIS_IPA=y — RNDIS-over-USB offload through IPA (USB transport — the DWC3 controller behind every off-device path)

PCIe/MHI modem proxy

off

CONFIG_IPA3_MHI_PROXY / MHI_PRIME_MANAGER not set — no external MHI modem

Kernel drivers: CONFIG_IPA3=y, CONFIG_IPA_WDI_UNIFIED_API=y, CONFIG_RMNET_IPA3=y, CONFIG_RNDIS_IPA=y. So the IPA core, its WLAN WDI path and USB RNDIS path are all compiled in; only the cellular and MHI consumers are inert.

Unlike the dormant modem stack elsewhere, this is not a pure reference-base leftover: its WLAN WDI2 / RNDIS consumer config is compiled in and active, though actual traffic through these paths was not directly observed.

7.9.3. Provenance

Source:

artifacts/boot_a/board.dts (qcom,ipa / qcom,rmnet-ipa3 / ipa-smmu-*-cb nodes — addresses, IRQs, HW version, firmware name, features) and artifacts/boot_a/kernel_config.txt (IPA3 / WDI / RMNET / RNDIS / MHI selection).

Method:

DTB node reading and kernel-config cross-check. No code executed.

Cross-refs:

Base kernel device tree (the SoC boot contract) (ipa_fw_region / ipa_gsi_region carve-outs, SMMU), ADSP and CDSP firmware (dormant modem/RMNET), Bluetooth / FM controller firmware (WCN3990 “Cherokee”) (active WCN3990 WLAN), USB transport — the DWC3 controller behind every off-device path (RNDIS tethering).