[Nexus 7 Q&A, Help & Troubleshooting] bftb0:
I have looked into this for a couple hours.

It might indeed be possible, but not without quite a bit more work. In fact, a significant enough effort that it might actually take someone unfamiliar with the territory more time than it takes to flash 100 tablets (I estimate that effort at about somewhere between 15 and 20 man-hours if done in a serial fashion with one "flashing station". Seems like a better approach would involve more than one "flashing station", though.)

I looked at current CWM and TWRP recoveries. In terms of pre-built stuff that is symlinked to the busybox, I note that TWRP have "tftp" and "ftp" and "wget", whereas CWM doesn't symlink any tool name with network functionality to it's busybox. The thinking here was that if a CIFS mount could be avoided by pulling file(s) down to the tablet with wget or ftp, that could simplify things - even raw IP could be used.

TWRP (and CWM) configures the kernel with

CONFIG_CIFS=m

but neither provide the kernel modules in their shipped recovery, nor the proprietary Broadcom drivers for the Broadcom 4330 WiFi/Bluetooth combo phy. (The latter is readily available though).

I kanged the latter into a booted TWRP recovery manually, and the firmware load seemed to take but there were other dhd_bus errors. Even if it had taken, there is still an lack of wpa_supplicant. That can be overcome by yanking one from elsewhere, but most of them are dynamically linked. That's not a big deal either - the supporting linker and shared libraries could in principle also be kanged into the recovery ramdisk as long as there is enough space in the boot partition. You have to recursively examine the shared libraries for dependencies though - one can pull in others that are not first-descendant dependents of "wpa_supplicant". (It needs stuff like SSL libs, etc).

But there is more; for example, examining the config for TWRP 2.4.1.0:

grep BCM config

# CONFIG_ARCH_BCMRING is not set

# CONFIG_BT_HCIBCM203X is not set

# CONFIG_BCM4329_RFKILL is not set

CONFIG_BCM4330_RFKILL=y

# CONFIG_BCM4329 is not set

CONFIG_BCMDHD=y

CONFIG_BCMDHD_FW_PATH="/system/vendor/firmware/fw_bcmdhd.bin"

CONFIG_BCMDHD_NVRAM_PATH="/system/etc/nvram.txt"

CONFIG_BCMA_POSSIBLE=y

# CONFIG_BCMA is not set

# CONFIG_BCM_WIMAX is not set

Note those paths in /system. I mention this because the recovery generally mounts the (flash memory) system partition right on top of /system in order to restore files during a ROM installation - which covers up any file contents stored below that mount point in the ramdisk during the time that the mount is active (file restore operations being performed into flash memory).

Same thing wpa_supplicant. Among other things, it wants to read things out of /data/misc/wifi/ e.g. wpa_supplicant.conf

Mount /data and that stuff gets covered up as well.

It might turn out that all that stuff only needs to to be read once; so I suppose if you could get the wlan0 interface configured to a pre-defined AP SSID (with no encryption and no authentication!), maybe that's only a minor issue.

Probably rather than kanging files this way and that, the right way to approach this is to clone the TWRP git repository, and modify paths and the build tree to have firmware and wpa_supplicant support infrastructure not live in either /system or /data - that way you could mount whatever you want at /data and /system without bolluxing up WiFi state management.

Or, mod the /sbin/recovery and "updater-binary" code to mount the system and data partitions at temporary mount points (instead of /system and /data) for the purpose of unpacking the ROM archives into their destination filesystems. Then any supporting firmware/configuration files for WiFi support could be done out of the ramdisk, and would not run the risk of being "covered by mounts".

Well, cheers. I'm not sure I should carry the ball on this any further, unless you have some coffee money on you.

It is tangentially related to understanding how to get Ad-hoc WiFi working, and I would like to see that though.

Maybe. Maybe not.

Good luck