Since commit c6b1b34b5090 ("media: pci: intel: Add CVS support for IPU
bridge driver") the internal camera no longer works on laptops where the
sensor sits behind an IVSC, for example a Dell XPS 16 9640 (IPU6,
INTC10CF, ov02c10):

  intel-ipu6 0000:00:05.0: Found supported sensor OVTI02C1:00
  intel-ipu6 0000:00:05.0: Connected 1 cameras
  ivsc_csi intel_vsc-92335fcf-3203-4472-af93-7b4453ac29da: mei-csi probed
      without device fwnode!

No sensor subdevice is registered, the media graph has no sensor entity
and userspace finds no camera at all.

ipu_bridge_get_ivsc_csi_dev() first looks for the platform device named
"intel_vsc" and returns its mei-csi child. That device is created by
mei_vsc, which on this machine only appears once the LJCA USB bridge and
its SPI controller have probed, about a second after the IPU6 probe that
runs the bridge:

  07:59:29.297  platform INTC10CF:00 created (ACPI scan)
  07:59:41      intel-ipu6 probe -> ipu_bridge_init()
  07:59:42.391  platform intel_vsc created (mei_vsc)

The commit above added two fallbacks for CVS which match on the ACPI
companion alone. They are reached for every entry of ivsc_acpi_ids[],
IVSC IDs included. The IVSC ACPI device has two physical nodes:

  INTC10CF:00/physical_node  -> platform/INTC10CF:00  (no driver bound)
  INTC10CF:00/physical_node1 -> platform/intel_vsc    (mei_vsc)

so bus_find_device_by_acpi_dev(&platform_bus_type, adev) returns the bare
platform device. ipu_bridge_instantiate_ivsc() then attaches the IVSC
software node to that device instead of to the mei-csi client, the bridge
reports success, and the probe is never retried. mei_csi later probes
without a fwnode, the CSI-2 link is never described, and the sensor ACPI
device, which has an honoured _DEP on the IVSC device, is never
enumerated.

Before those fallbacks existed the lookup returned NULL here, the bridge
failed with -ENODEV and the probe was retried once the IVSC device had
shown up.

Skip those fallbacks for IVSC devices, keying on the IVSC IDs rather than
the CVS ones: new CVS IDs keep being added, whereas the IVSC list is
complete. CVS binds a driver to the ACPI device itself, so matching on the
companion stays unambiguous there.

Fixes: c6b1b34b5090 ("media: pci: intel: Add CVS support for IPU bridge driver")
Link: https://lore.kernel.org/linux-media/20260901194526.6369-1-gvozdoder@gmail.com/
Cc: stable@vger.kernel.org
Assisted-by: Claude Code:claude-opus-5
Signed-off-by: Sergey Zagursky <gvozdoder@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Some laptops carry a MediaTek power table in their firmware, and the
driver reads it to set a transmit limit for each frequency range.  It
only fills in the ranges themselves when it registers the device.

The startup step that does this existed already, but it never programmed
anything.  Two recent commits made it run a regulatory update instead,
which sets the limits on the way through, long before registration.

As a result, on a machine that has the table the driver reads through an
empty pointer and the interface never appears:

  BUG: kernel NULL pointer dereference, address: 0000000000000004
  RIP: 0010:mt792x_init_acpi_sar_power
  Call Trace:
   mt7921_set_tx_sar_pwr
   mt7921_mcu_regd_update
   mt7921_regd_update
   mt7921_run_firmware
   mt7921e_mcu_init
   mt7921_init_work

Skip it when the ranges are missing. They are applied again once the
device is up, which is where they came from before.

Reported-by: Klara Modin <klarasmodin@gmail.com>
Closes: https://lore.kernel.org/linux-wireless/aoyxqHYvSuaBeubf@soda.int.kasm.eu/
Fixes: 9b80bd9cab40 ("wifi: mt76: mt7921: add regulatory wiphy self manager support")
Fixes: e9f3f1cc133f ("wifi: mt76: mt7925: add regulatory wiphy self manager support")
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Tested-by: David Gow <david@davidgow.net>
Tested-by: Klara Modin <klarasmodin@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Treat an out-of-range CLC index as newer firmware rather than a
malformed image. linux-firmware 20260810 ships MT7922 records with
idx 3, and rejecting them made mt7921e fail to probe.

Keep the record-length checks, and report those as errors so a
truncated table is visible instead of a silent retry loop.

Fixes: 9417c5818a01 ("wifi: mt76: mt7921: validate CLC firmware records")
Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Junjie Cao <junjie.cao@intel.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Work around a 'bindgen' 0.73.2 bug that emits an 'allow' attribute
     for 'unnecessary_transmutes', which is unknown in older compilers

   - Clean 'clippy::as_underscore' lints in generated code by the new
     'bindgen' 0.73.0+ releases

   - Clean new 'clippy::needless_range_loop' lint for the upcoming Rust
     1.100.0 (expected 2026-11-12)

  'kernel' crate:

   - 'num' module: fix soundness issue in 'Bounded' by sealing the
     'Integer' trait

  'pin-init' crate:

   - Fix unreachable warning for the upcoming Rust 1.100.0 (expected
     2026-11-12) due to 'Infallible' becoming an alias of '!'

  Samples:

   - Add missing newlines in 'pr_*!'s macro calls"

* tag 'rust-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: allow `unknown_lints` in generated bindings for Rust < 1.88
  rust: allow `clippy::as_underscore` in the generated bindings
  rust: num: seal Integer
  drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
  rust: samples: add missing newlines in rust_print_main
  rust: pin-init: use irrefutable pattern for `stack_pin_init`

Pull irq fix from Ingo Molnar:

 - Fix ARM gic-v5 irqchip driver regression, where its
   enable/disable functions may corrupt unrelated
   ICC_CR0_EL1 hardware state (Sascha Bischoff)

* tag 'irq-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/gic-v5: Preserve ICC_CR0_EL1 state

Pull EDAC fix from Borislav Petkov:

 - A single fix to altera_edac to use the proper objects when performing
   managed device operations instead of using temporary shallow struct
   copies which can cause dangling list pointers and havoc eventually

* tag 'edac_urgent_for_v7.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/altera: Use parent device for devres in altr_portb_setup()

Pull fbdev fixes from Helge Deller:
 "Two patches for VT core code and fbcon prevent potential out-of-bounds
  reads on font or screen size changes, one fix limits the Superblitter
  in atafb to supported modes only, and some minor fixes for vfb,
  ssd1307fb and omapfb"

* tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: vfb: defer cleanup until the last reference
  fbdev: atafb: Restrict SuperBlitter to supported formats
  fbdev: ssd1307fb: fix NULL pointer dereference on missing match data
  fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo
  fbdev: omapfb: Fix __be32 sparse warning in panel_enabled()
  vt: hide cursor prior to font changes to avoid out-of-bound reads

Pull IOMMU fixes from Joerg Roedel:
 "RISC-V:

   - Serialize command queue publication to prevent concurrent producers
     from exposing incomplete or out-of-order commands to hardware

   - Wait for queue space outside the command queue lock

   - Avoid waiting for IOFENCE completion when command enqueue failed

  AMD:

   - Prevent GA log buffers from being reallocated and leaked during
     resume, where allocation also occurs in an unsuitable syscore
     callback context

   - Fix a regression on older systems whose firmware advertises
     incorrect IOMMU features

   - Preserve allocation errors when assigning host domain IDs to nested
     domains

  s390:

   - Prevent a NULL dereference when translating an unmapped IOVA with
     five-level ZPCI translation tables

  Misc:

   - Remove a stale MAINTAINERS entry and clean up unused or redundant
     AMD IOMMU declarations, macros, and checks"

* tag 'iommu-fixes-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/amd: Remove unused macro
  iommu/amd: Remove redundant checks from interrupt handler path
  iommu/amd: Remove redundant check in irq_remapping_select()
  iommu/amd: Make iommu_sva_set_dev_pasid as static
  MAINTAINERS: Drop the nonexistent vsi-iommu.h file entry
  iommu/amd: Fix ineffective error check in nested domain allocation
  iommu/amd: Fix premature break in init_iommu_one() again
  iommu/amd: Do not reallocate GA log buffers on resume
  iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
  iommu/riscv: Avoid waiting on failed command enqueue
  iommu/riscv: Serialize command queue publishing
  iommu/riscv: Add command queue lock

Pull regulator fixes from Mark Brown:
 "One fix for pf1550 which checked for errors on multiple regulators
  but always notified via one of them regardless of which one had the
  problem, plus one device ID addition in the fan53555 DT bindings"

* tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: pf1550: fix which regulator is notified
  regulator: dt-bindings: fan53555: add tcs,tcs4526

Pull drm fixes from Dave Airlie:
 "Weekly fixes pull, this seems relatively quiet for the new world,
  scattered fixes, mostly amdgpu leading the way, but lots of minor
  fixes in other drivers.

  drm_exec:
   - fix 0 object handling

  sched:
   - null ptr deref fix in kunit tests

  amdgpu:
   - Freesync fix
   - GPUVM fix
   - Debugfs fixes
   - HDMI fixes
   - IPS fix
   - GPU reset fix
   - RGB quantization fixes
   - SMU 13.0.x fixes

  xe:
   - runtime PM guard fix
   - cache flushing fix

  i915:
   - Fix a memleak on perf config query error path
   - Fix UHBR SST SDP splitting when sink doesn't support it

  bridge:
   - fix ti-sn65dsi83 error handling
   - tc358768: Enforce input bus flags via atomic_check

  ast:
   - fix blend mode property on cursor plane

  qxl:
   - fix blend mode property on primary/cursor planes

  virtio:
   - fix blend mode property on cursor plane

  vboxvideo:
   - fix blend mode property on planes

  rockchip:
   - fix endpoint name length
   - fix Kconfig issues

  ivpu:
   - limit firmware log prints to field size
   - validate buffer range in ivpu address translation
   - validate fw log buffers

  ethosu:
   - ensure SRAM sizing
   - ensure cmd stream formatting
   - drop IRQF_SHARED
   - fix open return value

  adp:
   - fix Kconfig

  logicvc:
   - fix Kconfig"

* tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel: (38 commits)
  drm/amd/pm: report energy accumulator for smu 13.0.0
  drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
  drm/amd/display: Rebuild InfoFrames on output color space changes
  drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
  drm/amd/display: Propagate HDMI RGB quantization selectability
  Revert "drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info"
  drm/amdgpu: skip gfx switch_power_profile during GPU reset
  drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative
  drm/amd/display: Exit IPS before connector detection on resume
  drm/amd/display: Shorten hdmi_frl_status_polling_workqueue
  dm/amdgpu: fix malformed link_settings debugfs output
  drm/amdgpu: skip the VMID 0 flush for VRAM
  drm/amd/display: Consult MCCS FreeSync cap only if requested & supported
  drm/i915: Fix memory leak in query_perf_config_list()
  drm/i915/dp: Gate UHBR SST SDP splitting on sink capability
  drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
  drm/xe: Guard page-fault worker with runtime PM check
  drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
  drm/bridge: tc358768: Enforce input bus flags via atomic_check
  drm/drm_exec: fix up contended obj when num_objects is 0
  ...