Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>

Pull power sequencing fixes from Bartosz Golaszewski:

 - fix an ABBA deadlock in pwrseq unregister path

 - fix a use-after-free bug in pwrseq core

 - sort PCI device IDs in ascending order in pwrseq-pcie-m2

* tag 'pwrseq-fixes-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
  power: sequencing: pcie-m2: Sort PCI device IDs in ascending order
  pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()

The pwrseq core takes three locks in consistent order everywhere:

  pwrseq_sem -> pwrseq->rw_lock -> pwrseq->state_lock

pwrseq_get() -> pwrseq_match_device() takes pwrseq_sem for reading, then
rw_lock for reading. pwrseq_power_on()/pwrseq_power_off() take rw_lock
for reading and then state_lock.

pwrseq_device_unregister() is the only exception, it takes: state_lock,
then rw_lock for writing and finally pwrseq_sem for writing. This created
two potential ABBA deadlock situations that sashiko pointed out.

  - pwrseq_power_on/off() take rw_lock for reading then state_lock, while
    pwrseq_unregister() takes state_lock then rw_lock for writing
  - pwrseq_get() takes pwrseq_sem for reading then rw_lock for reading,
    while pwrseq_unregister() takes rw_lock for writing then pwrseq_sem
    for writing

Reorder the unregister path to taking pwrseq_sem for writing -> rw_lock
for writing and drop the state_lock entirely. This is safe as
enable_count is only ever written under rw_lock held for read (via
pwrseq_unit_enable()/disable(), reached only from pwrseq_power_on/off()),
so holding rw_lock for writing already excludes every other writer and
reader and the active-users WARN() stays race-free without state_lock.

Fixes: 249ebf3f65f8 ("power: sequencing: implement the pwrseq core")
Closes: https://sashiko.dev/#/patchset/20260616151049.1705503-1-vulab%40iscas.ac.cn
Link: https://patch.msgid.link/20260618-pwrseq-abba-deadlock-v1-1-943a3fd81c06@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Sort the entries in pwrseq_m2_pci_ids[] by device ID in ascending order:
0x1103 (WCN6855) before 0x1107 (WCN7850).

Fixes: 2abcfdd91e6a ("power: sequencing: pcie-m2: Add PCI ID 0x1103 for WCN6855 Bluetooth")
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Wei Deng <wei.deng@oss.qualcomm.com>
Link: https://patch.msgid.link/20260617143055.820096-1-wei.deng@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pwrseq_debugfs_seq_next() declares 'next' with __free(put_device),
which causes put_device() to be called on the returned pointer when
the variable goes out of scope.  This results in a use-after-free
since the seq_file framework receives a pointer whose reference has
already been dropped.

Simply removing __free(put_device) would fix the UAF but would leak
the reference acquired by bus_find_next_device(), as stop() only
calls up_read(&pwrseq_sem) and never releases the device reference.

Fix this by making the reference counting consistent across all
seq_file callbacks, matching the standard pattern used by PCI and
SCSI:

- start(): use get_device() so it returns a referenced pointer.
- next(): explicitly put_device(curr) to release the previous
  device's reference (no NULL check needed - the seq_file framework
  only calls next() while the previous return was non-NULL).
- stop(): put_device(data) to release the last iterated device's
  reference, with a NULL guard since stop() may be called with NULL
  when start() returned NULL or next() reached end-of-sequence.

Cc: stable@vger.kernel.org
Fixes: 249ebf3f65f8 ("power: sequencing: implement the pwrseq core")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260616151049.1705503-1-vulab@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Pull power supply and reset updates from Sebastian Reichel:
 "Power-supply drivers:

   - New EC driver providing battery info for Microsoft Surface RT

   - New driver for battery charger in Samsung S2M PMICs

   - Rework max17042 driver

   - sysfs control for bd71828 auto input current limitation

  All over:

   - Use named fields for struct platform_device_id and of_device_id
     entries

   - Misc small cleanups and fixes"

* tag 'for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (33 commits)
  Documentation: ABI: sysfs-class-reboot-mode-reboot_modes: fix doc warnings
  power: supply: charger-manager: fix refcount leak in is_full_charged()
  power: supply: core: fix supplied_from allocations
  power: supply: max17042_battery: Use modern PM ops to clear up warning
  power: supply: add support for Samsung S2M series PMIC charger device
  power: supply: Add support for Surface RT battery and charger
  dt-bindings: embedded-controller: Document Surface RT EC
  power: supply: bd71828: sysfs for auto input current limitation
  power: supply: cpcap-charger: include missing <linux/property.h>
  power: supply: cros_charge-control: Move MODULE_DEVICE_TABLE next to the table itself
  power: supply: ab8500_fg: Fix typos in comments
  power: supply: Use named initializers for arrays of i2c_device_data
  power: supply: Remove unused jz4740-battery.h
  power: reset: st-poweroff: Use of_device_get_match_data()
  power: supply: bq257xx: Add fields for 'charging' and 'overvoltage' states
  power: supply: bq257xx: Consistently use indirect get/set helpers
  power: supply: bq257xx: Make the default current limit a per-chip attribute
  power: supply: bq257xx: Fix VSYSMIN clamping logic
  power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
  power: supply: max17042: fix OF node reference imbalance
  ...

Pull power sequencing updates from Bartosz Golaszewski:
 "A set of extensions to the M.2 pwrseq driver allowing it to work with
  more cards than just the one from Qualcomm we supported initially.
  There's also a tweak to debugfs output and a new function that will be
  used by a bluetooth driver in the next cycle.

  Power Sequencing core:

   - Add a helper allowing consumers to access the struct device object
     associated with a pwrseq provider

   - Print the power sequencing device's parent in debugfs to add more
     debugging information

  Driver updates:

   - Extend/rework the M.2 power sequencing driver in order to allow it
     to support more M.2 cards, not just WCN7850"

* tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: pcie-m2: Add PCI ID 0x1103 for WCN6855 Bluetooth
  power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
  power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
  power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
  power: sequencing: pcie-m2: Improve PCI device ID check
  power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
  power: sequencing: pcie-m2: Fix inconsistent function prefixes
  power: sequencing: print power sequencing device parent in debugfs

In is_full_charged(), power_supply_get_by_name() is called to
obtain a reference to the fuel_gauge power supply. If the
voltage check (uV >= desc->fullbatt_uV) succeeds, the function
returns true directly without releasing the reference, leaking
the refcount.

Fix this by setting a flag and jumping to the out label where
power_supply_put() properly drops the reference.

Cc: stable@vger.kernel.org
Fixes: e132fc6bb89b ("power: supply: charger-manager: Make decisions focussed on battery status")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260611005322.53096-1-vulab@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>

If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.

Fixes: f6e0b081fb30 ("power_supply: Populate supplied_from hierarchy from the device tree")
Signed-off-by: Lucas Tsai <lucas_tsai@richtek.com>
Link: https://patch.msgid.link/20260609114403.3896073-1-lucas_tsai@richtek.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>

WCN6855 is a Qualcomm Wi-Fi/BT combo chip that uses PCI device ID
0x1103. Add it to pwrseq_m2_pci_ids[] alongside the existing 0x1107
(WCN7850) entry, so that the pwrseq-pcie-m2 driver creates a Bluetooth
serdev device for WCN6855 cards inserted into PCIe M.2 Key E connectors.

Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Wei Deng <wei.deng@oss.qualcomm.com>
Link: https://patch.msgid.link/20260608091702.3797437-2-wei.deng@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>