Revert "Revert "kernel: rng: Add IOCTL support to disable bus bandwidth""
This reverts commit 911fb8222bf5f4df424368a27b1c9f513db0a9d2

Change-Id: If9d4d8be7690c2cd7d4fffba084edb7247042dd0
kernel/msm: Add qrngp header file

Add qrngp header file, required for external/qrngd project.

Change-Id: Iac27ff57df91efe370ec749451142942289b23a8
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm8974: update crypto to kk_3.5, enable QCRYPTO in defconfig

Change-Id: I23259f7cbb9e8aef4ee4a04be68921992a5880b1
WCNSS: Add back comments

Change-Id: Ia3d0f0519be7ff04e7a9ded585ccb9413a5d0284
wlan: Store avoid channel list

Store avoid channel list into recoverable location.
If Softap mode detects current channel is not safe to use,
WLAN kernel module will be restarted.
Then WLAN kernel module internal storage will lost
unsafe channel information.
To avoid start softap with unsafe channel, channel information
should be stored in static location.

Change-Id: I5a6d7ab7314936d7bbaaf7a005e58179a4dc0613
CRs-fixed: 576020
Signed-off-by: Leo Chang <leochang@codeaurora.org>
wcnss: Add two registers to wcnss dump

When a WDI timeout or Watchdog bite happens at WCNSS, certain WCNSS
registers are logged for debug purpose.  Add alarms txctl and alarms
tactl registers to the dump

Change-Id: Id79345666dd7e5b3d43b13fff5d8230e4fd38655
CRs-fixed: 587892
Acked-by: Yuanyuan Liu <yuanliu@qca.qualcomm.com>
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
radio-iris: declare in a header, define in a source file

Change-Id: Ibf5b1d9f97c214e8bfcbe1339f645ea23e9d481e
wcnss: Add support to configure the Wlan MAC addr

    This change introduces a sysfs entry to allow userspace to
    configure the wlan MAC addr and exports an API which allows
    WLAN and other wireless technologies to query the wlan MAC
    addr

    Change-Id: I751b2cf2db1321926e8e16ef1baaa4fa3d8d06cf
    CRs-Fixed: 583465
    Signed-off-by:  <hkpatel@codeaurora.org>

Change-Id: I99e811de26abca74ddac9cc1b75c8eba02b8fa36
radio: iris: transport: move radio_hci_smd_init to __init section

Change-Id: I37aba71dc5fdee00054172ed46a20d93c3e77766
radio: iris: fix smd init when iris-transport is not compiled as module

Change-Id: Id0d9a36f93ec387e08be3d041e60113d2cf75aa8
m8: defconfig: enable Qualcomm IRIS Transport

Change-Id: If227a6644019fa0c61b6179d9e5be3787de2f4e9
Wifi : Switch to 3.2.3.172 revision of pronto driver

Change-Id: Iaa54bb149d7626b69df6cfa8b65fea31f213a4b9
staging: prima: add option to read calibration data from HTC NVS

Change-Id: Ic10b4891eee4071d6edf7aa7bea2b7994f914b2b
Wifi: Enable CONFIG_HTC_WIFI_NVS

Change-Id: Ica017023ea86ca1ee104ba4900bc400c38bbdc41
msm: htc_wifi_nvs: expose wifi calibration data to kernel

Change-Id: Ib21b2a25ee81e312fdccb9a0501e0709353f3541
Merge changes I23259f7c,Iac27ff57,If9d4d8be into cm-11.0

* changes:
  msm8974: update crypto to kk_3.5, enable QCRYPTO in defconfig
  kernel/msm: Add qrngp header file
  Revert "Revert "kernel: rng: Add IOCTL support to disable bus bandwidth"" This reverts commit 911fb8222bf5f4df424368a27b1c9f513db0a9d2
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: Ie0b03989fa8cfd6ffe40d1f770044fe7447dda05
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]
Merge changes If227a664,Id0d9a36f,I37aba71d,Ibf5b1d9f into cm-11.0

* changes:
  m8: defconfig: enable Qualcomm IRIS Transport
  radio: iris: fix smd init when iris-transport is not compiled as module
  radio: iris: transport: move radio_hci_smd_init to __init section
  radio-iris: declare in a header, define in a source file
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode" into cm-11.0
defconfig: disable perflock

Change-Id: I2dc98a36cee8f04014e04b7ddd1cce11ce6715ae