// libHalBridge: Translating Broadcom-style sync calls to nl80211 async int WIFI_HAL_TriggerScan_Shim(char *interface, int freq_list[]) { // Step 1: Convert RDK-B params to nl80211 scan request struct nl_msg *msg = nl80211_cmd_alloc(interface, NL80211_CMD_TRIGGER_SCAN); nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, NL80211_SCAN_FLAG_AP); // Step 2: Send async, but block using a conditional variable pthread_mutex_lock(&scan_mutex); scan_complete = 0; nl80211_send(msg);
Using gdb on the target, Mira found the culprit: the CcspWifiSsp thread had a blocking call to WIFI_HAL_GetStationList() that took 800ms on the QCA (because the shim had to dump the entire station table via netlink and translate it). During those 800ms, the main event loop starved. A background scan event arrived, but the HAL mutex was held. Deadlock. rdk-b integration with non-native wi-fi socs
The lab in Cupertino hummed with a familiar tension. On the bench lay two pieces of silicon that were never meant to talk to each other. One was the brain: a Broadcom BCM3390 system-on-chip (SoC), the native heart of the RDK-B stack. The other was a rebel: a Qualcomm QCA6391 Wi-Fi 6E SoC, plucked from a high-end laptop reference design. The mission, given by a Tier-1 operator named "Axiom Broadband," was simple in ask but monstrous in complexity: integrate the alien Wi-Fi chip into the RDK-B gateway as the sole access point. Deadlock
return (scan_success) ? 0 : -1; }
At the RDK Summit that year, Mira presented a session titled "Bridging the Gap: Non-Native Wi-Fi SoC Integration with RDK-B." The room was packed. Engineers from Juniper, Nokia, and CommScope took notes. One was the brain: a Broadcom BCM3390 system-on-chip
Sam built an event loop thread that listened to netlink broadcasts from the QCA chip, translating NL80211_CMD_NEW_STATION into RDK-B's internal WIFI_EVENT_STA_JOIN . It was tedious, but by day ten, the shim could fake a wl -style interface well enough to pass the HAL self-test. The next horror emerged: configuration. RDK-B uses the TR-181 data model (e.g., Device.WiFi.Radio.1.Channel ). The QCA driver used a binary blob called board.bin and a runtime config via iw and hostapd over a Unix socket.