[fbalazsy]

dtbs_check on t6040-j616s aborts since #403 (also noted in #412), so the J616s tree can't be validated:

Could not decode node phy@382a90000 property apple,tunable-common-cfg with value b'\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x01'
  File ".../dtschema/dtb.py", line 185, in prop_value
    if len(p) / type_format[fmt].size >= min_dim:
KeyError: 'uint8-array'

Cause. dtschema takes a property's type from a binding that names it exactly. Only when no binding names it does it collect the types of every binding's patternProperties. apple,pmp.yaml has the catch-all '^apple,tunable-' with type uint8-array. #403 describes the T6040 PHY and dwc3 tunables only through a pattern, with type uint32-matrix. So those names get both types, and dt-validate crashes while decoding them. apple,tunable-axi2af and -fabric decode only because apple,atcphy.yaml and apple,pcie.yaml already name them. Fixing only the PHY binding moves the same crash to usb@382280000 apple,tunable-gbl-default, so both bindings need the change.

Fix. Two commits, binding YAML only. Each tunable becomes an explicit property that refers to one shared $defs entry (uint32-matrix, offset/mask/value rows), as apple,atcphy.yaml already does. The accepted values are unchanged, and the DTS doesn't change.

1. dt-bindings: phy: apple,t6040-atcphy: Name the tunables explicitly (11 properties)
2. dt-bindings: usb: apple,dwc3: Name the T6040 tunables explicitly (5 properties)

How tested (dtschema 2026.9, on integration/aurora 1aa285750):

	Before	After
CHECK_DTBS=y apple/t6040-j616s.dtb	KeyError, validation aborted	no crash, 42 reports
all 115 apple/*.dtb	crash on J616s	no crash and no decode errors
dt_binding_check on both bindings	—	clean
checkpatch --strict	—	0 errors, 0 warnings

The 42 remaining reports are the same list that a dtschema without the crash prints before this change. None of them are about USB or the PHY. They are the missing macaudio/AOP schemas and dai-tdm-* on the dai-link, ti,sn012776 with SDZ-supply and apple,sdz-group-fail-closed (#406), nonposted-mmio on t6041 nodes, brcm wifi/bt, wifi-clkreq, mtp/tp-accel (#409), and sound-name-prefix on cs42l84.

Also: dtschema itself should report conflicting types instead of crashing. Line 185 of dtschema/dtb.py indexes type_format[fmt], where line 220 uses fmt.split('-', 1)[0]. That belongs upstream in dtschema and isn't part of this PR.

[fbalazsy]

Reopening: the crash is still there on the current integration/aurora (bee7a846b), and both commits apply to it unchanged (the three bindings involved haven't changed since 1aa285750).

Retest on bee7a846b (dtschema 2026.9):

	Before	After
CHECK_DTBS=y apple/t6040-j616s.dtb	KeyError: 'uint8-array' on phy@382a90000 apple,tunable-common-cfg, validation aborted	no crash, the same 42 reports as listed above
all 116 apple/*.dtb	crash on J616s	no crash, no decode errors
dt_binding_check on both bindings	—	clean
checkpatch --strict	—	0 errors, 0 warnings

[RyanTheTide]

Thanks, good catch. Our gate runs hit the same KeyError on t6040-j616s and we'd missed it: the other DTBs validated, so the abort was buried in the log. With this merged onto integration/aurora 2e9e457 (dtschema 2026.9), dt_binding_check on both bindings is clean, all 116 Apple DTBs validate, there's no KeyError or decode error, and t6040-j616s now gets its 42 reports, none of them about the PHY or USB tunables. Only the two T6040 bindings change. Merging.