Bluetooth: hci_bcm4377: Add hardware reset recovery and post-init restoration

[JJRPF]

Problem

On Apple Silicon Macs using Broadcom PCIe Bluetooth controllers (bcm4377, bcm4378, bcm4387, bcm4388 driven by hci_bcm4377), stopping the radio or cycling rfkill during heavy traffic (such as active LE scanning, discovery, or audio streaming) causes transfer and completion ring destruction commands to time out in bcm4377_hci_close().

When ring destruction fails, the controller hardware is left in an unrecoverable state:

1. The firmware rings remain allocated and desynchronized.
2. Subsequent bcm4377_hci_open() calls fail immediately when attempting to recreate transfer rings (bcm4377_create_ring fails).
3. The controller is completely wedged until an unbind/bind of the PCIe driver via sysfs or a full machine reboot.

Solution

1. Hardware Reset Recovery (bcm4377_pci_reset):

   • Track teardown failures in bcm4377_hci_close() and set needs_reset = true.
   • On the next open (or if ring creation fails), execute a PCIe Function-Level Reset (pci_reset_function).
   • Re-initialize PCI config space, restore MSI vectors, reset ring states, reboot firmware (bcm4377_boot), and re-establish the Real-Time Interface (bcm4377_setup_rti).

2. Synchronous Post-Init Hook (hdev->post_init):

   • Because hardware reset wipes internal SRAM, the silicon loses its calibration, regulatory PTB tables, and programmed MAC address, reverting to Broadcom's ROM placeholder (43:88:C0:00:76:93).
   • Implement bcm4377_hci_post_init (executed synchronously inside hci_dev_open_sync() under hdev->req_lock immediately after HCI_OP_RESET):
     • Reloads beamforming and calibration blobs via send_calibration.
     • Reloads regulatory PTB tables via send_ptb.
     • Restores the device's authentic BD_ADDR into the silicon registers via vendor opcode 0xfc01 (bcm4377_hci_set_bdaddr), and updates hdev->bdaddr.

Testing & Verification

• Tested on an Apple MacBook Pro 14" (M2 Pro, Mac14,9) with Broadcom BCM4388 on Linux 7.1.13-3-1-ARCH.
• Verified fault recovery under active LE discovery and advertising:
  • Abrupt ring destruction teardown failure captured.
  • Driver automatically performed PCIe FLR reset.
  • Firmware rebooted cleanly and RTI synchronized.
  • post_init reloaded calibration, PTB, and restored factory MAC (6C:7E:67:CA:E2:2E).
  • Class of Device (0x006c010c) and device name restored.
  • Paired Bluetooth devices (Sennheiser MOMENTUM 4, Dell wireless keyboard/mouse) connect cleanly without key drops.

AI Disclosure & Attribution

In compliance with Documentation/process/coding-assistants.rst:

• Assisted-by: Antigravity:gemini-3.8-flash
• This code was developed with AI assistance (Google Antigravity / Gemini 3.8 Flash) and has been human-reviewed, compiled, and tested on bare-metal Apple Silicon hardware.

Assisted-by: Antigravity:gemini-3.8-flash
Signed-off-by: Justin Pfister 119864532+JJRPF@users.noreply.github.com