AUTOBLEEM-15: the 1.0 dongle firmware set, rtl8723bu/88x2bu, Bluetooth as modules

.gitattributes

@@ -19,3 +19,5 @@ board/psc/install_payload.sh     text eol=lf
 board/psc/overlay/**        text eol=lf
 board/psc/overlay/bin/ntpget binary
 board/psc/device_table.txt   text eol=lf
+# the 1.0 dongle firmware: blobs
+board/psc/firmware-1.0/overlay/** binary

.gitmodules

@@ -2,3 +2,7 @@
 	path = sources/psc-kernel
 	url = https://github.com/autobleem2/psc-kernel.git
 	branch = develop
+[submodule "sources/rtl88x2bu"]
+	path = sources/rtl88x2bu
+	url = https://github.com/RinCat/RTL88x2BU-Linux-Driver.git
+	branch = master

CLAUDE.md

@@ -209,8 +209,13 @@ produces a complete, valid payload in `output/images/psc-payload/kernel/`:
 5. ~~**Hardware test**~~ — DONE 2026-09-25/26 on the owner's console (`feature/pad-drivers`): boots, the
    launcher runs, modules load, DS3 (USB + cable pairing through abbtagent) and DS4 over Bluetooth work,
    WiFi (RT5370) joins, pairings survive a reboot. See "On the console" below.
-6. Out-of-tree modern USB-WiFi drivers (8812au/8821cu/88x2bu/mt76) as vendored kernel trees (the big
-   dongle win) — see `docs/kernel-and-drivers.md`.
+6. Out-of-tree modern USB-WiFi drivers (8812au/8821cu/88x2bu/mt76) (the big dongle win) — see
+   `docs/kernel-and-drivers.md`. Started with AUTOBLEEM-15 (2026-10-10, the 1.0 firmware set back): rtl8723bu is
+   vendored in the psc-kernel tree (`CONFIG_RTL8723BU=m`, `linux-common.fragment`); 88x2bu, 109 MB of vendor
+   source, is the submodule `sources/rtl88x2bu` instead, which `build-kernel.sh` builds against the kernel into
+   `lib/modules/4.4.22/extra` (`AB_KERNEL_EXT_MODULES`, set by `scripts/build.sh`). The 1.0 firmware that
+   linux-firmware lacks is the second overlay `board/psc/firmware-1.0/` (its README has the list). mt76x0u/mt76x2u
+   (MT7610U/MT7612U, whose firmware is there) still have no driver.
 
 ## On the console (2026-09-25/26) - what the hardware taught, each now checked by `verify.sh`
 

board/psc/build-kernel.sh

@@ -79,6 +79,25 @@ M -j"${JOBS}" Image modules
 rm -rf "${MODROOT}/lib/modules"
 M INSTALL_MOD_PATH="${MODROOT}" INSTALL_MOD_STRIP=1 DEPMOD="${DEPMOD}" modules_install
 KREL="$(cat "${KBUILD}/include/config/kernel.release")"
+
+# Out-of-tree drivers (vendor Wi-Fi drivers too big to vendor into psc-kernel): each dir in AB_KERNEL_EXT_MODULES
+# (scripts/build.sh sets it) is copied into the stage, so its submodule stays clean, built against this kernel with
+# its own Makefile and installed stripped into extra/; depmod again so modules.alias carries them too
+EXTRA_DIR="${MODROOT}/lib/modules/${KREL}/extra"
+for src in ${AB_KERNEL_EXT_MODULES:-}; do
+	name="$(basename "${src}")"
+	[ -f "${src}/Makefile" ] || { echo "[kernel] ERROR: no Makefile in ${src} (git submodule update --init)"; exit 1; }
+	rm -rf "${STAGE}/ext/${name}"; mkdir -p "${STAGE}/ext" "${EXTRA_DIR}"
+	cp -a "${src}" "${STAGE}/ext/${name}"
+	make -C "${STAGE}/ext/${name}" -j"${JOBS}" ARCH=arm CROSS_COMPILE="${CROSS}" KSRC="${KBUILD}" KVER="${KREL}" \
+		"${KCC[@]}" modules
+	for ko in "${STAGE}/ext/${name}"/*.ko; do
+		"${CROSS}strip" --strip-debug -o "${EXTRA_DIR}/$(basename "${ko}")" "${ko}"
+		echo "[kernel] + out of tree: $(basename "${ko}") (${name})"
+	done
+done
+[ -z "${AB_KERNEL_EXT_MODULES:-}" ] || "${DEPMOD}" -b "${MODROOT}" "${KREL}"
+
 for f in modules.dep modules.alias; do
 	[ -s "${MODROOT}/lib/modules/${KREL}/${f}" ] || { echo "[kernel] ERROR: depmod wrote no ${f} for ${KREL}"; exit 1; }
 done

board/psc/firmware-1.0/README.md

@@ -0,0 +1,19 @@
+# firmware-1.0 - the USB dongle firmware AutoBleem 1.0 shipped that linux-firmware (Buildroot) does not
+
+`overlay/` is a second `BR2_ROOTFS_OVERLAY` of both defconfigs: its `lib/firmware` lands in `abrootfs.tgz` next to
+what the `BR2_PACKAGE_LINUX_FIRMWARE_*` options install. The files are byte for byte the ones in the 1.0 payload's
+`abrootfs.tgz` (autobleem-console-tools history, blob `25e051f5`, before TOOLS-3 removed the old payload).
+
+| Files | For | Driver |
+|---|---|---|
+| `brcm/*.hcd` (114) | Broadcom USB Bluetooth (BCM20702 and relatives) | `btusb` + `btbcm` |
+| `mediatek/mt7610u.bin` | MediaTek MT7610U USB Wi-Fi | none in 4.4 yet (mt76x0u) |
+| `mediatek/mt7662u.bin`, `mt7662u_rom_patch.bin` | MediaTek MT7612U USB Wi-Fi | none in 4.4 yet (mt76x2u) |
+| `rtlwifi/rtl8822bufw.bin` | Realtek RTL8822BU USB Wi-Fi | `88x2bu` (sources/rtl88x2bu) carries its own copy; kept for 1.0 parity |
+
+The rest of the 1.0 set comes from Buildroot's linux-firmware instead: `rtl_bt/*` (`RTL_87XX_BT`, `RTL_88XX_BT`) and
+`htc_7010.fw` (`ATHEROS_7010`). The 1.0 blobs for PCI/PCIe cards are left out - the console has no PCI.
+
+The `.hcd` files are Broadcom's Bluetooth patch RAM files as Windows driver packages carry them; the MediaTek and
+Realtek files are the vendors' redistributable firmware (linux-firmware's own licences, `LICENCE.mediatek`,
+`LICENCE.rtlwifi_firmware.txt`).

board/psc/linux-common.fragment

@@ -59,3 +59,14 @@ CONFIG_RTL8192C_COMMON=m
 CONFIG_RTL8192CU=m
 # VIA VT6656 (staging)
 CONFIG_VT6656=m
+# Realtek RTL8723BU Wi-Fi (Edimax EW-7611ULB and others) - the vendored lwfinger driver in the psc-kernel tree,
+# module 8723bu; its Bluetooth half is btusb's (below). RTL8822BU (88x2bu) is built out of tree:
+# sources/rtl88x2bu, see build-kernel.sh
+CONFIG_RTL8723BU=m
+
+# ---- USB Bluetooth -----------------------------------------------------------------------------------------------
+# btusb and its Realtek helper as modules, so a newer btusb (a new dongle id, a newer btrtl for the 8761B/8821C/
+# 8822B chips 4.4 does not know) is a .ko on the payload, not a new boot.img. BT_BCM stays built in: the UART
+# Broadcom driver selects it.
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_RTL=m

configs/psc_defconfig

@@ -40,7 +40,7 @@ BR2_INIT_NONE=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 # the overlayfs whiteouts that switch the console's syslog units off (board/psc/device_table.txt)
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt $(BR2_EXTERNAL_PSC_PATH)/board/psc/device_table.txt"
-BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_PSC_PATH)/board/psc/overlay"
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_PSC_PATH)/board/psc/overlay $(BR2_EXTERNAL_PSC_PATH)/board/psc/firmware-1.0/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-build.sh"
 BR2_ROOTFS_POST_FAKEROOT_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-fakeroot.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-image.sh"
@@ -128,6 +128,11 @@ BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7601U=y
 # ath9k_htc and carl9170, which board/psc/linux-common.fragment turns on for both variants
 BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9271=y
 BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9170=y
+# the rest of the 1.0 dongle set (AUTOBLEEM-15): AR7010, Realtek USB Bluetooth (btusb loads rtl_bt/ for the 87xx/88xx
+# combo chips); board/psc/firmware-1.0 has the 1.0 files linux-firmware lacks
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_7010=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX_BT=y
 
 # ---- Rootfs image: we tar the target ourselves in post-image (abrootfs.tgz) ----
 BR2_TARGET_ROOTFS_TAR=y

configs/psc_next_defconfig

@@ -41,7 +41,7 @@ BR2_INIT_NONE=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 # the overlayfs whiteouts that switch the console's syslog units off (board/psc/device_table.txt)
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt $(BR2_EXTERNAL_PSC_PATH)/board/psc/device_table.txt"
-BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_PSC_PATH)/board/psc/overlay"
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_PSC_PATH)/board/psc/overlay $(BR2_EXTERNAL_PSC_PATH)/board/psc/firmware-1.0/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-build.sh"
 BR2_ROOTFS_POST_FAKEROOT_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-fakeroot.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_PSC_PATH)/board/psc/post-image.sh"
@@ -127,6 +127,11 @@ BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7601U=y
 BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT7650=y
 BR2_PACKAGE_LINUX_FIRMWARE_MEDIATEK_MT76X2E=y
 BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_9271=y
+# the rest of the 1.0 dongle set (AUTOBLEEM-15): AR7010, Realtek USB Bluetooth (btusb loads rtl_bt/ for the 87xx/88xx
+# combo chips); board/psc/firmware-1.0 has the 1.0 files linux-firmware lacks
+BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_7010=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX_BT=y
+BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX_BT=y
 BR2_PACKAGE_LINUX_FIRMWARE_ATHEROS_CARL9170=y
 BR2_PACKAGE_LINUX_FIRMWARE_ATH6K=y
 BR2_PACKAGE_LINUX_FIRMWARE_ATH9K_HTC=y

scripts/build.sh

@@ -57,6 +57,9 @@ KSTAGE="${O}/kernel-stage"
 # linux-common.fragment for both variants (pad drivers as modules, the in-tree USB WiFi drivers), next adds its own
 KFRAG="${HERE}/board/psc/linux-common.fragment"
 [ "${VARIANT}" = "next" ] && KFRAG="${KFRAG} ${HERE}/board/psc/linux-extra-wifi.fragment"
+# out-of-tree drivers build-kernel.sh builds against the kernel into lib/modules/<ver>/extra (both variants):
+# RTL8822BU Wi-Fi (88x2bu), whose firmware 1.0 shipped (board/psc/firmware-1.0)
+export AB_KERNEL_EXT_MODULES="${HERE}/sources/rtl88x2bu"
 
 log(){ printf '\033[1;36m[build:%s]\033[0m %s\n' "${VARIANT}" "$*"; }
 die(){ printf '\033[1;31m[build:%s] ERROR:\033[0m %s\n' "${VARIANT}" "$*" >&2; exit 1; }

sources/README.md

@@ -1,2 +1,4 @@
 # sources/psc-kernel is a git submodule: github.com/autobleem2/psc-kernel, branch master (the MT8167
 # Linux 4.4.22 vendor fork, with the gcc>=10 build fixes). `git submodule update --init` fetches it.
+# sources/rtl88x2bu is a git submodule too: github.com/RinCat/RTL88x2BU-Linux-Driver (the RTL8822BU Wi-Fi
+# driver, module 88x2bu), built out of tree against the kernel by board/psc/build-kernel.sh.