[jgoyvaerts]

T6040 (M4 Pro) support for the Apple ISP driver, so the FaceTime HD camera works on the MacBook Pro M4 Pro. The T6040 ISP is T8140's ISP17a block with the same H17 firmware interface, so this is a hardware descriptor on top of the existing T8140 path plus a few small deltas.

• Binding: apple,t6041-isp (fallback apple,isp), in its own schema with a select, so it doesn't apply to the T8140 node through the shared fallback. Firmware TEXT and DATA are reserved memory mapped at the addresses the firmware runs them at, next to its main memory window. It has eight power domains (sys, cpu, fe, dprx, secure, be, clr, sensor), a doorbell window of its own (mbox2) and apple,cam-connections-scheme. There is no capture watchdog.
• Lens shading fix (H17): zero the lens shading strides. The H17 firmware reads that halfword of the xx24 setfiles' lens shading records as the high half of the table offset, so FlowLSC200 faulted on every CH_SET_FILE_LOAD. Apple's xx25 setfiles are their xx24 twins with exactly those halfwords zeroed. Setfiles that already have them zeroed are left alone. It comes before the T6040 commit, so every commit streams on hardware. T8140's sensors are still turned away as unsupported, so nothing changes there today; once they are enabled, their setfiles go through it too (the xx24 siblings of 7523 and 7622 in appleh16camerad carry such strides).
• T6040 support:
  • The firmware is started as iBoot left it, with no reset sequence. The driver checks that the coprocessor has not run yet and that its reset vector is the firmware text, and refuses to start anything else.
  • No clock enable word; legacy boot mode 1.
  • The boot descriptor carries the camera connection layout and the 0xde600000-byte shared window, as macOS passes them.
  • The broadcast-clear command takes four windows in eight slots. The H17 command now takes several windows; T8140 still sends its single one.
  • The firmware's PMGR, PMP and DSID registers are mapped 1:1 through its DART, from the J616s ADT's address filter ranges, as for T8140.
  • iBoot's TEXT+DATA end 80 KiB short of the firmware's 32 MiB main memory. The driver backs the rest with zeroed pages, as macOS does. Without them, the firmware's first writes fault and it never answers its first command.
  • Output goes through scaler 1. There is no capture metadata pool or watchdog.
  • Front camera: IMX958 (sensor 0x958, lens 0x29), with setfile 2224. Section 0x50f of each Apple setfile names its sensor; of the 32 setfiles in appleh16camerad, only 2224 names 0x958 (2924 and 2921 name the IMX614). With 2224, the firmware logs the same module match as macOS and reports no lens shading calibration mismatch.

Firmware / setfile: iBoot loads the ISP firmware itself; the driver doesn't load it. The driver requests one file, apple/isp_2224_01XX.dat: the IMX958 setfile 0x22240106, cut to 0x6ff4 bytes. asahi-fwextract doesn't produce it because it only reads appleh13camerad. Our packaging extracts it from macOS's /usr/sbin/appleh16camerad with tools/firmware-from-macos.sh (https://github.com/jgoyvaerts/omarchy-m4/blob/main/tools/firmware-from-macos.sh).

Hardware tested on: Apple MacBook Pro (16-inch, M4 Pro, 2024), J616s / T6040, macOS 26.6.x firmware, booted by our own loader with our private T6040 device tree.

How tested: On our daily kernel 7.3.0-m4.3: probe, then 1920x1080 NV12 at 30 fps with v4l2-ctl. Auto-exposure settles by about frame 15 in a lit room. Close and reopen work. Capture works through PipeWire in a browser, and keeps working after suspend/resume (checked on 7.1.12).

The lens shading fixup was also run in userspace, as the same C function, over all 32 setfiles in appleh16camerad and over truncated copies of each, under AddressSanitizer: no access outside the file, every xx25 file unchanged, and 4 to 24 records changed in 21 of the other 24.

Not tested / limits:

• Only the 1080p/720p presets of config 5 have been used.
• Firmware denoise tuning (macOS's RNF/MBNR/TNR commands) isn't sent, so the image is a bit grainy in low light.
• The resident firmware can't be restarted: if the driver fails or is unbound, the camera stays unusable until the next boot.

Not in this PR / dependencies:

• The T6040 DT nodes (ISP, its three DARTs, ISP power states) are not included. They will come as deltas on the t604x DT tree, after the bindings in dt-bindings: Apple M4 Pro/Max (T6040/T6041) compatibles #372.
• At runtime, the ISP DART's address filter must be programmed, which the bootloader does.
• The binding itself doesn't depend on dt-bindings: Apple M4 Pro/Max (T6040/T6041) compatibles #372.

Overlap: draft #231 (J616S ISP preparation) touches the same driver files and keeps the T6040 match gated. This PR is the working T6040 match on today's integration. I'm happy to rebase onto #231 if it lands first.

Base: integration/aurora (51cda52). Built and checked there:

• m4_defconfig with VIDEO_APPLE_ISP=m.
• W=1 on drivers/media/platform/apple/isp/, with no warnings.
• checkpatch --strict, clean apart from the MAINTAINERS reminder for the new schema: the driver has no MAINTAINERS entry, and the schema names its maintainer.
• dt_binding_check with dtschema 2026.9, for apple,t6041-isp.yaml and apple,t8140-isp.yaml.

Hardware testing was done on our daily tree, which is based on integration/aurora (ed55042, Linux 7.3) and carries the same code plus two timeout diagnostics left out here.

🤖 Generated with Claude Code