diff --git a/[refs] b/[refs]
index 6a3960591a70..1f3069440db0 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c69d0a15d240a854f6d620ac7d5238a41883a920
+refs/heads/master: a2c2c3a71c25627e4840795b3c269918d0e71b28
diff --git a/trunk/Makefile b/trunk/Makefile
index 2309b435c07f..6fccf6531770 100644
--- a/trunk/Makefile
+++ b/trunk/Makefile
@@ -720,11 +720,11 @@ endif # INSTALL_MOD_STRIP
 export mod_strip_cmd
 
 
-ifdef CONFIG_MODULE_SIG_ALL
+ifeq ($(CONFIG_MODULE_SIG),y)
 MODSECKEY = ./signing_key.priv
 MODPUBKEY = ./signing_key.x509
 export MODPUBKEY
-mod_sign_cmd = perl $(srctree)/scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY)
+mod_sign_cmd = perl $(srctree)/scripts/sign-file $(MODSECKEY) $(MODPUBKEY)
 else
 mod_sign_cmd = true
 endif
diff --git a/trunk/arch/alpha/kernel/traps.c b/trunk/arch/alpha/kernel/traps.c
index 4037461a6493..272666d006df 100644
--- a/trunk/arch/alpha/kernel/traps.c
+++ b/trunk/arch/alpha/kernel/traps.c
@@ -186,7 +186,7 @@ die_if_kernel(char * str, struct pt_regs *regs, long err, unsigned long *r9_15)
 #endif
 	printk("%s(%d): %s %ld\n", current->comm, task_pid_nr(current), str, err);
 	dik_show_regs(regs, r9_15);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	dik_show_trace((unsigned long *)(regs+1));
 	dik_show_code((unsigned int *)regs->pc);
 
diff --git a/trunk/arch/arm/kernel/traps.c b/trunk/arch/arm/kernel/traps.c
index 1c089119b2d7..b0179b89a04c 100644
--- a/trunk/arch/arm/kernel/traps.c
+++ b/trunk/arch/arm/kernel/traps.c
@@ -296,7 +296,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
 
 	bust_spinlocks(0);
 	die_owner = -1;
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	die_nest_count--;
 	if (!die_nest_count)
 		/* Nest count reaches zero, release the lock. */
diff --git a/trunk/arch/arm64/kernel/traps.c b/trunk/arch/arm64/kernel/traps.c
index b3c5f628bdb4..3883f842434f 100644
--- a/trunk/arch/arm64/kernel/traps.c
+++ b/trunk/arch/arm64/kernel/traps.c
@@ -242,7 +242,7 @@ void die(const char *str, struct pt_regs *regs, int err)
 		crash_kexec(regs);
 
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	raw_spin_unlock_irq(&die_lock);
 	oops_exit();
 
diff --git a/trunk/arch/avr32/kernel/traps.c b/trunk/arch/avr32/kernel/traps.c
index 682b2478691a..3d760c06f024 100644
--- a/trunk/arch/avr32/kernel/traps.c
+++ b/trunk/arch/avr32/kernel/traps.c
@@ -61,7 +61,7 @@ void die(const char *str, struct pt_regs *regs, long err)
 	show_regs_log_lvl(regs, KERN_EMERG);
 	show_stack_log_lvl(current, regs->sp, regs, KERN_EMERG);
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die_lock);
 
 	if (in_interrupt())
diff --git a/trunk/arch/hexagon/kernel/traps.c b/trunk/arch/hexagon/kernel/traps.c
index be5e2dd9c9d3..a41eeb8eeaa1 100644
--- a/trunk/arch/hexagon/kernel/traps.c
+++ b/trunk/arch/hexagon/kernel/traps.c
@@ -225,7 +225,7 @@ int die(const char *str, struct pt_regs *regs, long err)
 	do_show_stack(current, &regs->r30, pt_elr(regs));
 
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 
 	spin_unlock_irq(&die.lock);
 
diff --git a/trunk/arch/ia64/kernel/traps.c b/trunk/arch/ia64/kernel/traps.c
index f7f9f9c6caf0..bd42b76000d1 100644
--- a/trunk/arch/ia64/kernel/traps.c
+++ b/trunk/arch/ia64/kernel/traps.c
@@ -72,7 +72,7 @@ die (const char *str, struct pt_regs *regs, long err)
 
 	bust_spinlocks(0);
 	die.lock_owner = -1;
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die.lock);
 
 	if (!regs)
diff --git a/trunk/arch/m68k/kernel/traps.c b/trunk/arch/m68k/kernel/traps.c
index f32ab22e7ed3..cbc624af4494 100644
--- a/trunk/arch/m68k/kernel/traps.c
+++ b/trunk/arch/m68k/kernel/traps.c
@@ -1176,7 +1176,7 @@ void die_if_kernel (char *str, struct pt_regs *fp, int nr)
 	console_verbose();
 	printk("%s: %08x\n",str,nr);
 	show_registers(fp);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	do_exit(SIGSEGV);
 }
 
diff --git a/trunk/arch/mips/kernel/traps.c b/trunk/arch/mips/kernel/traps.c
index 9007966d56d4..cf7ac5483f53 100644
--- a/trunk/arch/mips/kernel/traps.c
+++ b/trunk/arch/mips/kernel/traps.c
@@ -396,7 +396,7 @@ void __noreturn die(const char *str, struct pt_regs *regs)
 
 	printk("%s[#%d]:\n", str, ++die_counter);
 	show_registers(regs);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	raw_spin_unlock_irq(&die_lock);
 
 	oops_exit();
diff --git a/trunk/arch/parisc/kernel/traps.c b/trunk/arch/parisc/kernel/traps.c
index aeb8f8f2c07a..45ba99f5080b 100644
--- a/trunk/arch/parisc/kernel/traps.c
+++ b/trunk/arch/parisc/kernel/traps.c
@@ -282,7 +282,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
 
 	show_regs(regs);
 	dump_stack();
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 
 	if (in_interrupt())
 		panic("Fatal exception in interrupt");
diff --git a/trunk/arch/powerpc/kernel/traps.c b/trunk/arch/powerpc/kernel/traps.c
index 37cc40ef5043..f9b751b29558 100644
--- a/trunk/arch/powerpc/kernel/traps.c
+++ b/trunk/arch/powerpc/kernel/traps.c
@@ -146,7 +146,7 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
 {
 	bust_spinlocks(0);
 	die_owner = -1;
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	die_nest_count--;
 	oops_exit();
 	printk("\n");
diff --git a/trunk/arch/s390/kernel/traps.c b/trunk/arch/s390/kernel/traps.c
index 13dd63fba367..70ecfc5fe8f0 100644
--- a/trunk/arch/s390/kernel/traps.c
+++ b/trunk/arch/s390/kernel/traps.c
@@ -271,7 +271,7 @@ void die(struct pt_regs *regs, const char *str)
 	print_modules();
 	show_regs(regs);
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die_lock);
 	if (in_interrupt())
 		panic("Fatal exception in interrupt");
diff --git a/trunk/arch/sh/kernel/traps.c b/trunk/arch/sh/kernel/traps.c
index dfdad72c61ca..72246bc06884 100644
--- a/trunk/arch/sh/kernel/traps.c
+++ b/trunk/arch/sh/kernel/traps.c
@@ -38,7 +38,7 @@ void die(const char *str, struct pt_regs *regs, long err)
 	notify_die(DIE_OOPS, str, regs, err, 255, SIGSEGV);
 
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die_lock);
 	oops_exit();
 
diff --git a/trunk/arch/sparc/kernel/setup_64.c b/trunk/arch/sparc/kernel/setup_64.c
index 88a127b9c69e..0eaf0059aaef 100644
--- a/trunk/arch/sparc/kernel/setup_64.c
+++ b/trunk/arch/sparc/kernel/setup_64.c
@@ -115,7 +115,7 @@ static void __init process_switch(char c)
 			break;
 		}
 		cheetah_pcache_forced_on = 1;
-		add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+		add_taint(TAINT_MACHINE_CHECK);
 		cheetah_enable_pcache();
 		break;
 
diff --git a/trunk/arch/sparc/kernel/traps_32.c b/trunk/arch/sparc/kernel/traps_32.c
index 662982946a89..a5785ea2a85d 100644
--- a/trunk/arch/sparc/kernel/traps_32.c
+++ b/trunk/arch/sparc/kernel/traps_32.c
@@ -58,7 +58,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
 
 	printk("%s(%d): %s [#%d]\n", current->comm, task_pid_nr(current), str, ++die_counter);
 	show_regs(regs);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 
 	__SAVE; __SAVE; __SAVE; __SAVE;
 	__SAVE; __SAVE; __SAVE; __SAVE;
diff --git a/trunk/arch/sparc/kernel/traps_64.c b/trunk/arch/sparc/kernel/traps_64.c
index 8d38ca97aa23..e7ecf1507d90 100644
--- a/trunk/arch/sparc/kernel/traps_64.c
+++ b/trunk/arch/sparc/kernel/traps_64.c
@@ -2383,7 +2383,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
 	notify_die(DIE_OOPS, str, regs, 0, 255, SIGSEGV);
 	__asm__ __volatile__("flushw");
 	show_regs(regs);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	if (regs->tstate & TSTATE_PRIV) {
 		struct thread_info *tp = current_thread_info();
 		struct reg_window *rw = (struct reg_window *)
diff --git a/trunk/arch/unicore32/kernel/traps.c b/trunk/arch/unicore32/kernel/traps.c
index 0870b68d2ad9..2054f0d4db13 100644
--- a/trunk/arch/unicore32/kernel/traps.c
+++ b/trunk/arch/unicore32/kernel/traps.c
@@ -231,7 +231,7 @@ void die(const char *str, struct pt_regs *regs, int err)
 	ret = __die(str, err, thread, regs);
 
 	bust_spinlocks(0);
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die_lock);
 	oops_exit();
 
diff --git a/trunk/arch/x86/kernel/cpu/amd.c b/trunk/arch/x86/kernel/cpu/amd.c
index fa96eb0d02fb..edd77e7508b3 100644
--- a/trunk/arch/x86/kernel/cpu/amd.c
+++ b/trunk/arch/x86/kernel/cpu/amd.c
@@ -219,7 +219,8 @@ static void __cpuinit amd_k7_smp_check(struct cpuinfo_x86 *c)
 	 */
 	WARN_ONCE(1, "WARNING: This combination of AMD"
 		" processors is not suitable for SMP.\n");
-	add_taint(TAINT_UNSAFE_SMP, LOCKDEP_NOW_UNRELIABLE);
+	if (!test_taint(TAINT_UNSAFE_SMP))
+		add_taint(TAINT_UNSAFE_SMP);
 
 valid_k7:
 	;
diff --git a/trunk/arch/x86/kernel/cpu/mcheck/mce.c b/trunk/arch/x86/kernel/cpu/mcheck/mce.c
index 7bc126346ace..fc7608a89d93 100644
--- a/trunk/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/trunk/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1082,7 +1082,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
 		/*
 		 * Set taint even when machine check was not enabled.
 		 */
-		add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+		add_taint(TAINT_MACHINE_CHECK);
 
 		severity = mce_severity(&m, cfg->tolerant, NULL);
 
diff --git a/trunk/arch/x86/kernel/cpu/mcheck/p5.c b/trunk/arch/x86/kernel/cpu/mcheck/p5.c
index 1c044b1ccc59..2d5454cd2c4f 100644
--- a/trunk/arch/x86/kernel/cpu/mcheck/p5.c
+++ b/trunk/arch/x86/kernel/cpu/mcheck/p5.c
@@ -33,7 +33,7 @@ static void pentium_machine_check(struct pt_regs *regs, long error_code)
 			smp_processor_id());
 	}
 
-	add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_MACHINE_CHECK);
 }
 
 /* Set up machine check reporting for processors with Intel style MCE: */
diff --git a/trunk/arch/x86/kernel/cpu/mcheck/winchip.c b/trunk/arch/x86/kernel/cpu/mcheck/winchip.c
index e9a701aecaa1..2d7998fb628c 100644
--- a/trunk/arch/x86/kernel/cpu/mcheck/winchip.c
+++ b/trunk/arch/x86/kernel/cpu/mcheck/winchip.c
@@ -15,7 +15,7 @@
 static void winchip_machine_check(struct pt_regs *regs, long error_code)
 {
 	printk(KERN_EMERG "CPU0: Machine Check Exception.\n");
-	add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_MACHINE_CHECK);
 }
 
 /* Set up machine check reporting on the Winchip C6 series */
diff --git a/trunk/arch/x86/kernel/cpu/mtrr/generic.c b/trunk/arch/x86/kernel/cpu/mtrr/generic.c
index fa72a39e5d46..e9fe907cd249 100644
--- a/trunk/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/trunk/arch/x86/kernel/cpu/mtrr/generic.c
@@ -542,7 +542,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
 
 		if (tmp != mask_lo) {
 			printk(KERN_WARNING "mtrr: your BIOS has configured an incorrect mask, fixing it.\n");
-			add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+			add_taint(TAINT_FIRMWARE_WORKAROUND);
 			mask_lo = tmp;
 		}
 	}
diff --git a/trunk/arch/x86/kernel/dumpstack.c b/trunk/arch/x86/kernel/dumpstack.c
index c8797d55b245..ae42418bc50f 100644
--- a/trunk/arch/x86/kernel/dumpstack.c
+++ b/trunk/arch/x86/kernel/dumpstack.c
@@ -232,7 +232,7 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
 
 	bust_spinlocks(0);
 	die_owner = -1;
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	die_nest_count--;
 	if (!die_nest_count)
 		/* Nest count reaches zero, release the lock. */
diff --git a/trunk/arch/xtensa/kernel/traps.c b/trunk/arch/xtensa/kernel/traps.c
index ded955d45155..01e0111bf787 100644
--- a/trunk/arch/xtensa/kernel/traps.c
+++ b/trunk/arch/xtensa/kernel/traps.c
@@ -524,7 +524,7 @@ void die(const char * str, struct pt_regs * regs, long err)
 	if (!user_mode(regs))
 		show_stack(NULL, (unsigned long*)regs->areg[1]);
 
-	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_DIE);
 	spin_unlock_irq(&die_lock);
 
 	if (in_interrupt())
diff --git a/trunk/drivers/acpi/custom_method.c b/trunk/drivers/acpi/custom_method.c
index 12b62f2cdb3f..6adfc706a1de 100644
--- a/trunk/drivers/acpi/custom_method.c
+++ b/trunk/drivers/acpi/custom_method.c
@@ -66,7 +66,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
 		buf = NULL;
 		if (ACPI_FAILURE(status))
 			return -EINVAL;
-		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
+		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
 	}
 
 	return count;
diff --git a/trunk/drivers/acpi/osl.c b/trunk/drivers/acpi/osl.c
index 8080588f88cb..908b02d5da1b 100644
--- a/trunk/drivers/acpi/osl.c
+++ b/trunk/drivers/acpi/osl.c
@@ -661,7 +661,7 @@ static void acpi_table_taint(struct acpi_table_header *table)
 	pr_warn(PREFIX
 		"Override [%4.4s-%8.8s], this is unsafe: tainting kernel\n",
 		table->signature, table->oem_table_id);
-	add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
 }
 
 
diff --git a/trunk/drivers/base/regmap/regmap-debugfs.c b/trunk/drivers/base/regmap/regmap-debugfs.c
index 81d6f605c92e..78d5f20c5f5b 100644
--- a/trunk/drivers/base/regmap/regmap-debugfs.c
+++ b/trunk/drivers/base/regmap/regmap-debugfs.c
@@ -279,7 +279,7 @@ static ssize_t regmap_map_write_file(struct file *file,
 		return -EINVAL;
 
 	/* Userspace has been fiddling around behind the kernel's back */
-	add_taint(TAINT_USER, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_USER);
 
 	regmap_write(map, reg, value);
 	return buf_size;
diff --git a/trunk/include/linux/kernel.h b/trunk/include/linux/kernel.h
index 80d36874689b..c566927efcbd 100644
--- a/trunk/include/linux/kernel.h
+++ b/trunk/include/linux/kernel.h
@@ -398,11 +398,7 @@ extern int panic_on_unrecovered_nmi;
 extern int panic_on_io_nmi;
 extern int sysctl_panic_on_stackoverflow;
 extern const char *print_tainted(void);
-enum lockdep_ok {
-	LOCKDEP_STILL_OK,
-	LOCKDEP_NOW_UNRELIABLE
-};
-extern void add_taint(unsigned flag, enum lockdep_ok);
+extern void add_taint(unsigned flag);
 extern int test_taint(unsigned flag);
 extern unsigned long get_taint(void);
 extern int root_mountflags;
diff --git a/trunk/include/linux/module.h b/trunk/include/linux/module.h
index ead1b5719a12..1375ee3f03aa 100644
--- a/trunk/include/linux/module.h
+++ b/trunk/include/linux/module.h
@@ -396,13 +396,13 @@ bool is_module_address(unsigned long addr);
 bool is_module_percpu_address(unsigned long addr);
 bool is_module_text_address(unsigned long addr);
 
-static inline int within_module_core(unsigned long addr, const struct module *mod)
+static inline int within_module_core(unsigned long addr, struct module *mod)
 {
 	return (unsigned long)mod->module_core <= addr &&
 	       addr < (unsigned long)mod->module_core + mod->core_size;
 }
 
-static inline int within_module_init(unsigned long addr, const struct module *mod)
+static inline int within_module_init(unsigned long addr, struct module *mod)
 {
 	return (unsigned long)mod->module_init <= addr &&
 	       addr < (unsigned long)mod->module_init + mod->init_size;
diff --git a/trunk/init/Kconfig b/trunk/init/Kconfig
index 968c539f0ac3..28c5b9dcc91e 100644
--- a/trunk/init/Kconfig
+++ b/trunk/init/Kconfig
@@ -1670,17 +1670,6 @@ config MODULE_SIG_FORCE
 	  Reject unsigned modules or signed modules for which we don't have a
 	  key.  Without this, such modules will simply taint the kernel.
 
-config MODULE_SIG_ALL
-	bool "Automatically sign all modules"
-	default y
-	depends on MODULE_SIG
-	help
-	  Sign all modules during make modules_install. Without this option,
-	  modules must be signed manually, using the scripts/sign-file tool.
-
-comment "Do not forget to sign required modules with scripts/sign-file"
-	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
-
 choice
 	prompt "Which hash algorithm should modules be signed with?"
 	depends on MODULE_SIG
@@ -1713,15 +1702,6 @@ config MODULE_SIG_SHA512
 
 endchoice
 
-config MODULE_SIG_HASH
-	string
-	depends on MODULE_SIG
-	default "sha1" if MODULE_SIG_SHA1
-	default "sha224" if MODULE_SIG_SHA224
-	default "sha256" if MODULE_SIG_SHA256
-	default "sha384" if MODULE_SIG_SHA384
-	default "sha512" if MODULE_SIG_SHA512
-
 endif # MODULES
 
 config INIT_ALL_POSSIBLE
diff --git a/trunk/kernel/Makefile b/trunk/kernel/Makefile
index eceac38f3c65..6c072b6da239 100644
--- a/trunk/kernel/Makefile
+++ b/trunk/kernel/Makefile
@@ -153,7 +153,23 @@ kernel/modsign_certificate.o: signing_key.x509 extra_certificates
 # fail and that the kernel may be used afterwards.
 #
 ###############################################################################
-ifndef CONFIG_MODULE_SIG_HASH
+sign_key_with_hash :=
+ifeq ($(CONFIG_MODULE_SIG_SHA1),y)
+sign_key_with_hash := -sha1
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA224),y)
+sign_key_with_hash := -sha224
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA256),y)
+sign_key_with_hash := -sha256
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA384),y)
+sign_key_with_hash := -sha384
+endif
+ifeq ($(CONFIG_MODULE_SIG_SHA512),y)
+sign_key_with_hash := -sha512
+endif
+ifeq ($(sign_key_with_hash),)
 $(error Could not determine digest type to use from kernel config)
 endif
 
@@ -166,8 +182,8 @@ signing_key.priv signing_key.x509: x509.genkey
 	@echo "### needs to be run as root, and uses a hardware random"
 	@echo "### number generator if one is available."
 	@echo "###"
-	openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
-		-batch -x509 -config x509.genkey \
+	openssl req -new -nodes -utf8 $(sign_key_with_hash) -days 36500 -batch \
+		-x509 -config x509.genkey \
 		-outform DER -out signing_key.x509 \
 		-keyout signing_key.priv
 	@echo "###"
diff --git a/trunk/kernel/module.c b/trunk/kernel/module.c
index 921bed4794e9..eab08274ec9b 100644
--- a/trunk/kernel/module.c
+++ b/trunk/kernel/module.c
@@ -197,10 +197,9 @@ static inline int strong_try_module_get(struct module *mod)
 		return -ENOENT;
 }
 
-static inline void add_taint_module(struct module *mod, unsigned flag,
-				    enum lockdep_ok lockdep_ok)
+static inline void add_taint_module(struct module *mod, unsigned flag)
 {
-	add_taint(flag, lockdep_ok);
+	add_taint(flag);
 	mod->taints |= (1U << flag);
 }
 
@@ -728,7 +727,7 @@ static inline int try_force_unload(unsigned int flags)
 {
 	int ret = (flags & O_TRUNC);
 	if (ret)
-		add_taint(TAINT_FORCED_RMMOD, LOCKDEP_NOW_UNRELIABLE);
+		add_taint(TAINT_FORCED_RMMOD);
 	return ret;
 }
 #else
@@ -1139,7 +1138,7 @@ static int try_to_force_load(struct module *mod, const char *reason)
 	if (!test_taint(TAINT_FORCED_MODULE))
 		printk(KERN_WARNING "%s: %s: kernel tainted.\n",
 		       mod->name, reason);
-	add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint_module(mod, TAINT_FORCED_MODULE);
 	return 0;
 #else
 	return -ENOEXEC;
@@ -2148,8 +2147,7 @@ static void set_license(struct module *mod, const char *license)
 		if (!test_taint(TAINT_PROPRIETARY_MODULE))
 			printk(KERN_WARNING "%s: module license '%s' taints "
 				"kernel.\n", mod->name, license);
-		add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
-				 LOCKDEP_NOW_UNRELIABLE);
+		add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
 	}
 }
 
@@ -2702,10 +2700,10 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
 	}
 
 	if (!get_modinfo(info, "intree"))
-		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
+		add_taint_module(mod, TAINT_OOT_MODULE);
 
 	if (get_modinfo(info, "staging")) {
-		add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
+		add_taint_module(mod, TAINT_CRAP);
 		printk(KERN_WARNING "%s: module is from the staging directory,"
 		       " the quality is unknown, you have been warned.\n",
 		       mod->name);
@@ -2871,17 +2869,15 @@ static int check_module_license_and_versions(struct module *mod)
 	 * using GPL-only symbols it needs.
 	 */
 	if (strcmp(mod->name, "ndiswrapper") == 0)
-		add_taint(TAINT_PROPRIETARY_MODULE, LOCKDEP_NOW_UNRELIABLE);
+		add_taint(TAINT_PROPRIETARY_MODULE);
 
 	/* driverloader was caught wrongly pretending to be under GPL */
 	if (strcmp(mod->name, "driverloader") == 0)
-		add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
-				 LOCKDEP_NOW_UNRELIABLE);
+		add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
 
 	/* lve claims to be GPL but upstream won't provide source */
 	if (strcmp(mod->name, "lve") == 0)
-		add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
-				 LOCKDEP_NOW_UNRELIABLE);
+		add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
 
 #ifdef CONFIG_MODVERSIONS
 	if ((mod->num_syms && !mod->crcs)
@@ -3145,72 +3141,12 @@ static int may_init_module(void)
 	return 0;
 }
 
-/*
- * We try to place it in the list now to make sure it's unique before
- * we dedicate too many resources.  In particular, temporary percpu
- * memory exhaustion.
- */
-static int add_unformed_module(struct module *mod)
-{
-	int err;
-	struct module *old;
-
-	mod->state = MODULE_STATE_UNFORMED;
-
-again:
-	mutex_lock(&module_mutex);
-	if ((old = find_module_all(mod->name, true)) != NULL) {
-		if (old->state == MODULE_STATE_COMING
-		    || old->state == MODULE_STATE_UNFORMED) {
-			/* Wait in case it fails to load. */
-			mutex_unlock(&module_mutex);
-			err = wait_event_interruptible(module_wq,
-					       finished_loading(mod->name));
-			if (err)
-				goto out_unlocked;
-			goto again;
-		}
-		err = -EEXIST;
-		goto out;
-	}
-	list_add_rcu(&mod->list, &modules);
-	err = 0;
-
-out:
-	mutex_unlock(&module_mutex);
-out_unlocked:
-	return err;
-}
-
-static int complete_formation(struct module *mod, struct load_info *info)
-{
-	int err;
-
-	mutex_lock(&module_mutex);
-
-	/* Find duplicate symbols (must be called under lock). */
-	err = verify_export_symbols(mod);
-	if (err < 0)
-		goto out;
-
-	/* This relies on module_mutex for list integrity. */
-	module_bug_finalize(info->hdr, info->sechdrs, mod);
-
-	/* Mark state as coming so strong_try_module_get() ignores us,
-	 * but kallsyms etc. can see us. */
-	mod->state = MODULE_STATE_COMING;
-
-out:
-	mutex_unlock(&module_mutex);
-	return err;
-}
-
 /* Allocate and load the module: note that size of section 0 is always
    zero, and we rely on this for optional sections. */
 static int load_module(struct load_info *info, const char __user *uargs,
 		       int flags)
 {
-	struct module *mod;
+	struct module *mod, *old;
 	long err;
 
 	err = module_sig_check(info);
@@ -3228,20 +3164,36 @@ static int load_module(struct load_info *info, const char __user *uargs,
 		goto free_copy;
 	}
 
-	/* Reserve our place in the list. */
-	err = add_unformed_module(mod);
-	if (err)
+	/*
+	 * We try to place it in the list now to make sure it's unique
+	 * before we dedicate too many resources.  In particular,
+	 * temporary percpu memory exhaustion.
+	 */
+	mod->state = MODULE_STATE_UNFORMED;
+again:
+	mutex_lock(&module_mutex);
+	if ((old = find_module_all(mod->name, true)) != NULL) {
+		if (old->state == MODULE_STATE_COMING
+		    || old->state == MODULE_STATE_UNFORMED) {
+			/* Wait in case it fails to load. */
+			mutex_unlock(&module_mutex);
+			err = wait_event_interruptible(module_wq,
+					       finished_loading(mod->name));
+			if (err)
+				goto free_module;
+			goto again;
+		}
+		err = -EEXIST;
+		mutex_unlock(&module_mutex);
 		goto free_module;
+	}
+	list_add_rcu(&mod->list, &modules);
+	mutex_unlock(&module_mutex);
 
 #ifdef CONFIG_MODULE_SIG
 	mod->sig_ok = info->sig_ok;
-	if (!mod->sig_ok) {
-		printk_once(KERN_NOTICE
-			    "%s: module verification failed: signature and/or"
-			    " required key missing - tainting kernel\n",
-			    mod->name);
-		add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_STILL_OK);
-	}
+	if (!mod->sig_ok)
+		add_taint_module(mod, TAINT_FORCED_MODULE);
 #endif
 
 	/* Now module is in final location, initialize linked lists, etc. */
@@ -3284,11 +3236,21 @@ static int load_module(struct load_info *info, const char __user *uargs,
 
 	dynamic_debug_setup(info->debug, info->num_debug);
 
-	/* Finally it's fully formed, ready to start executing. */
-	err = complete_formation(mod, info);
-	if (err)
+	mutex_lock(&module_mutex);
+	/* Find duplicate symbols (must be called under lock). */
+	err = verify_export_symbols(mod);
+	if (err < 0)
 		goto ddebug_cleanup;
 
+	/* This relies on module_mutex for list integrity. */
+	module_bug_finalize(info->hdr, info->sechdrs, mod);
+
+	/* Mark state as coming so strong_try_module_get() ignores us,
+	 * but kallsyms etc. can see us. */
+	mod->state = MODULE_STATE_COMING;
+
+	mutex_unlock(&module_mutex);
+
 	/* Module is ready to execute: parsing args may do that. */
 	err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
 			 -32768, 32767, &ddebug_dyndbg_module_param_cb);
@@ -3312,8 +3274,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
 	/* module_bug_cleanup needs module_mutex protection */
 	mutex_lock(&module_mutex);
 	module_bug_cleanup(mod);
-	mutex_unlock(&module_mutex);
  ddebug_cleanup:
+	mutex_unlock(&module_mutex);
 	dynamic_debug_remove(info->debug);
 	synchronize_sched();
 	kfree(mod->args);
diff --git a/trunk/kernel/panic.c b/trunk/kernel/panic.c
index 7c57cc9eee2c..e1b2822fff97 100644
--- a/trunk/kernel/panic.c
+++ b/trunk/kernel/panic.c
@@ -259,19 +259,26 @@ unsigned long get_taint(void)
 	return tainted_mask;
 }
 
-/**
- * add_taint: add a taint flag if not already set.
- * @flag: one of the TAINT_* constants.
- * @lockdep_ok: whether lock debugging is still OK.
- *
- * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for
- * some notewortht-but-not-corrupting cases, it can be set to true.
- */
-void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
+void add_taint(unsigned flag)
 {
-	if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
-		printk(KERN_WARNING
-		       "Disabling lock debugging due to kernel taint\n");
+	/*
+	 * Can't trust the integrity of the kernel anymore.
+	 * We don't call directly debug_locks_off() because the issue
+	 * is not necessarily serious enough to set oops_in_progress to 1
+	 * Also we want to keep up lockdep for staging/out-of-tree
+	 * development and post-warning case.
+	 */
+	switch (flag) {
+	case TAINT_CRAP:
+	case TAINT_OOT_MODULE:
+	case TAINT_WARN:
+	case TAINT_FIRMWARE_WORKAROUND:
+		break;
+
+	default:
+		if (__debug_locks_off())
+			printk(KERN_WARNING "Disabling lock debugging due to kernel taint\n");
+	}
 
 	set_bit(flag, &tainted_mask);
 }
@@ -414,8 +421,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
 	print_modules();
 	dump_stack();
 	print_oops_end_marker();
-	/* Just a warning, don't kill lockdep. */
-	add_taint(taint, LOCKDEP_STILL_OK);
+	add_taint(taint);
 }
 
 void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...)
diff --git a/trunk/kernel/sched/core.c b/trunk/kernel/sched/core.c
index fc9103e9ff03..f1bdecf09afb 100644
--- a/trunk/kernel/sched/core.c
+++ b/trunk/kernel/sched/core.c
@@ -2796,7 +2796,7 @@ static noinline void __schedule_bug(struct task_struct *prev)
 	if (irqs_disabled())
 		print_irqtrace_events(prev);
 	dump_stack();
-	add_taint(TAINT_WARN, LOCKDEP_STILL_OK);
+	add_taint(TAINT_WARN);
 }
 
 /*
diff --git a/trunk/kernel/sysctl.c b/trunk/kernel/sysctl.c
index d8df00e69c14..95e9e55602a8 100644
--- a/trunk/kernel/sysctl.c
+++ b/trunk/kernel/sysctl.c
@@ -2018,7 +2018,7 @@ static int proc_taint(struct ctl_table *table, int write,
 		int i;
 		for (i = 0; i < BITS_PER_LONG && tmptaint >> i; i++) {
 			if ((tmptaint >> i) & 1)
-				add_taint(i, LOCKDEP_STILL_OK);
+				add_taint(i);
 		}
 	}
 
diff --git a/trunk/lib/bug.c b/trunk/lib/bug.c
index 168603477f02..d0cdf14c651a 100644
--- a/trunk/lib/bug.c
+++ b/trunk/lib/bug.c
@@ -166,8 +166,7 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
 		print_modules();
 		show_regs(regs);
 		print_oops_end_marker();
-		/* Just a warning, don't kill lockdep. */
-		add_taint(BUG_GET_TAINT(bug), LOCKDEP_STILL_OK);
+		add_taint(BUG_GET_TAINT(bug));
 		return BUG_TRAP_TYPE_WARN;
 	}
 
diff --git a/trunk/mm/memory.c b/trunk/mm/memory.c
index 494526ae024a..705473afc1f4 100644
--- a/trunk/mm/memory.c
+++ b/trunk/mm/memory.c
@@ -720,7 +720,7 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr,
 		print_symbol(KERN_ALERT "vma->vm_file->f_op->mmap: %s\n",
 				(unsigned long)vma->vm_file->f_op->mmap);
 	dump_stack();
-	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_BAD_PAGE);
 }
 
 static inline bool is_cow_mapping(vm_flags_t flags)
diff --git a/trunk/mm/page_alloc.c b/trunk/mm/page_alloc.c
index 0dade3f18f7d..e9075fdef695 100644
--- a/trunk/mm/page_alloc.c
+++ b/trunk/mm/page_alloc.c
@@ -333,7 +333,7 @@ static void bad_page(struct page *page)
 out:
 	/* Leave bad fields for debug, except PageBuddy could make trouble */
 	page_mapcount_reset(page); /* remove PageBuddy */
-	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_BAD_PAGE);
 }
 
 /*
diff --git a/trunk/mm/slab.c b/trunk/mm/slab.c
index 856e4a192d25..e7667a3584bc 100644
--- a/trunk/mm/slab.c
+++ b/trunk/mm/slab.c
@@ -812,7 +812,7 @@ static void __slab_error(const char *function, struct kmem_cache *cachep,
 	printk(KERN_ERR "slab error in %s(): cache `%s': %s\n",
 	       function, cachep->name, msg);
 	dump_stack();
-	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_BAD_PAGE);
 }
 #endif
 
diff --git a/trunk/mm/slub.c b/trunk/mm/slub.c
index 4aec53705e4f..ebcc44eb43b9 100644
--- a/trunk/mm/slub.c
+++ b/trunk/mm/slub.c
@@ -562,7 +562,7 @@ static void slab_bug(struct kmem_cache *s, char *fmt, ...)
 	printk(KERN_ERR "----------------------------------------"
 			"-------------------------------------\n\n");
 
-	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_BAD_PAGE);
 }
 
 static void slab_fix(struct kmem_cache *s, char *fmt, ...)
diff --git a/trunk/scripts/mod/modpost.c b/trunk/scripts/mod/modpost.c
index 1c6fbb1a4f8e..ff36c508a10e 100644
--- a/trunk/scripts/mod/modpost.c
+++ b/trunk/scripts/mod/modpost.c
@@ -830,8 +830,6 @@ static const char *section_white_list[] =
 	".toc*",
 	".xt.prop",				 /* xtensa */
 	".xt.lit",         /* xtensa */
-	".arcextmap*",			/* arc */
-	".gnu.linkonce.arcext*",	/* arc : modules */
 	NULL
 };
 
diff --git a/trunk/scripts/sign-file b/trunk/scripts/sign-file
index 2b7c4484d46c..974a20b661b7 100755
--- a/trunk/scripts/sign-file
+++ b/trunk/scripts/sign-file
@@ -2,44 +2,50 @@
 #
 # Sign a module file using the given key.
 #
-
-my $USAGE =
-"Usage: scripts/sign-file [-v] <hash algo> <key> <x509> <module> [<dest>]\n" .
-"       scripts/sign-file [-v] -s <raw sig> <hash algo> <x509> <module> [<dest>]\n";
-
+# Format:
+#
+#	./scripts/sign-file [-v] <key> <x509> <module> [<dest>]
+#
+#
 use strict;
 use FileHandle;
 use IPC::Open2;
-use Getopt::Std;
 
-my %opts;
-getopts('vs:', \%opts) or die $USAGE;
-my $verbose = $opts{'v'};
-my $signature_file = $opts{'s'};
+my $verbose = 0;
+if ($#ARGV >= 0 && $ARGV[0] eq "-v") {
+    $verbose = 1;
+    shift;
+}
 
-die $USAGE if ($#ARGV > 4);
-die $USAGE if (!$signature_file && $#ARGV < 3 || $signature_file && $#ARGV < 2);
+die "Format: ./scripts/sign-file [-v] <key> <x509> <module> [<dest>]\n"
+    if ($#ARGV != 2 && $#ARGV != 3);
 
-my $dgst = shift @ARGV;
-my $private_key;
-if (!$signature_file) {
-	$private_key = shift @ARGV;
-}
-my $x509 = shift @ARGV;
-my $module = shift @ARGV;
-my ($dest, $keep_orig);
-if (@ARGV) {
-	$dest = $ARGV[0];
-	$keep_orig = 1;
-} else {
-	$dest = $module . "~";
-}
+my $private_key = $ARGV[0];
+my $x509 = $ARGV[1];
+my $module = $ARGV[2];
+my $dest = ($#ARGV == 3) ? $ARGV[3] : $ARGV[2] . "~";
 
-die "Can't read private key\n" if (!$signature_file && !-r $private_key);
-die "Can't read signature file\n" if ($signature_file && !-r $signature_file);
+die "Can't read private key\n" unless (-r $private_key);
 die "Can't read X.509 certificate\n" unless (-r $x509);
 die "Can't read module\n" unless (-r $module);
 
+#
+# Read the kernel configuration
+#
+my %config = (
+    CONFIG_MODULE_SIG_SHA512 => 1
+    );
+
+if (-r ".config") {
+    open(FD, "<.config") || die ".config";
+    while (<FD>) {
+	if ($_ =~ /^(CONFIG_.*)=[ym]/) {
+	    $config{$1} = 1;
+	}
+    }
+    close(FD);
+}
+
 #
 # Function to read the contents of a file into a variable.
 #
@@ -315,71 +321,73 @@ my $id_type = 1;	# Identifier type: X.509
 #
 # Digest the data
 #
-my $prologue;
-if ($dgst eq "sha1") {
+my ($dgst, $prologue) = ();
+if (exists $config{"CONFIG_MODULE_SIG_SHA1"}) {
     $prologue = pack("C*",
 		     0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
 		     0x2B, 0x0E, 0x03, 0x02, 0x1A,
 		     0x05, 0x00, 0x04, 0x14);
+    $dgst = "-sha1";
     $hash = 2;
-} elsif ($dgst eq "sha224") {
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA224"}) {
     $prologue = pack("C*",
 		     0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
 		     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
 		     0x05, 0x00, 0x04, 0x1C);
+    $dgst = "-sha224";
     $hash = 7;
-} elsif ($dgst eq "sha256") {
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA256"}) {
     $prologue = pack("C*",
 		     0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
 		     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
 		     0x05, 0x00, 0x04, 0x20);
+    $dgst = "-sha256";
     $hash = 4;
-} elsif ($dgst eq "sha384") {
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA384"}) {
     $prologue = pack("C*",
 		     0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
 		     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
 		     0x05, 0x00, 0x04, 0x30);
+    $dgst = "-sha384";
     $hash = 5;
-} elsif ($dgst eq "sha512") {
+} elsif (exists $config{"CONFIG_MODULE_SIG_SHA512"}) {
     $prologue = pack("C*",
 		     0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
 		     0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
 		     0x05, 0x00, 0x04, 0x40);
+    $dgst = "-sha512";
     $hash = 6;
 } else {
-    die "Unknown hash algorithm: $dgst\n";
+    die "Can't determine hash algorithm";
 }
 
+#
+# Generate the digest and read from openssl's stdout
+#
+my $digest;
+$digest = readpipe("openssl dgst $dgst -binary $module") || die "openssl dgst";
+
+#
+# Generate the binary signature, which will be just the integer that comprises
+# the signature with no metadata attached.
+#
+my $pid;
+$pid = open2(*read_from, *write_to,
+	     "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
+    die "openssl rsautl";
+binmode write_to;
+print write_to $prologue . $digest || die "pipe to openssl rsautl";
+close(write_to) || die "pipe to openssl rsautl";
+
+binmode read_from;
 my $signature;
-if ($signature_file) {
-	$signature = read_file($signature_file);
-} else {
-	#
-	# Generate the digest and read from openssl's stdout
-	#
-	my $digest;
-	$digest = readpipe("openssl dgst -$dgst -binary $module") || die "openssl dgst";
-
-	#
-	# Generate the binary signature, which will be just the integer that
-	# comprises the signature with no metadata attached.
-	#
-	my $pid;
-	$pid = open2(*read_from, *write_to,
-		     "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
-	    die "openssl rsautl";
-	binmode write_to;
-	print write_to $prologue . $digest || die "pipe to openssl rsautl";
-	close(write_to) || die "pipe to openssl rsautl";
-
-	binmode read_from;
-	read(read_from, $signature, 4096) || die "pipe from openssl rsautl";
-	close(read_from) || die "pipe from openssl rsautl";
-	waitpid($pid, 0) || die;
-	die "openssl rsautl died: $?" if ($? >> 8);
-}
+read(read_from, $signature, 4096) || die "pipe from openssl rsautl";
+close(read_from) || die "pipe from openssl rsautl";
 $signature = pack("n", length($signature)) . $signature,
 
+waitpid($pid, 0) || die;
+die "openssl rsautl died: $?" if ($? >> 8);
+
 #
 # Build the signed binary
 #
@@ -416,6 +424,6 @@ print FD
     ;
 close FD || die $dest;
 
-if (!$keep_orig) {
+if ($#ARGV != 3) {
     rename($dest, $module) || die $module;
 }
diff --git a/trunk/security/integrity/ima/ima_main.c b/trunk/security/integrity/ima/ima_main.c
index 5127afcc4b89..5b14a0946d6e 100644
--- a/trunk/security/integrity/ima/ima_main.c
+++ b/trunk/security/integrity/ima/ima_main.c
@@ -284,7 +284,8 @@ int ima_module_check(struct file *file)
 {
 	if (!file) {
 #ifndef CONFIG_MODULE_SIG_FORCE
-		if (ima_appraise & IMA_APPRAISE_MODULES)
+		if ((ima_appraise & IMA_APPRAISE_MODULES) &&
+		    (ima_appraise & IMA_APPRAISE_ENFORCE))
 			return -EACCES;	/* INTEGRITY_UNKNOWN */
 #endif
 		return 0;	/* We rely on module signature checking */
diff --git a/trunk/sound/soc/soc-core.c b/trunk/sound/soc/soc-core.c
index b7e84a7cd9ee..8df1b3feaf2b 100644
--- a/trunk/sound/soc/soc-core.c
+++ b/trunk/sound/soc/soc-core.c
@@ -251,7 +251,7 @@ static ssize_t codec_reg_write_file(struct file *file,
 		return -EINVAL;
 
 	/* Userspace has been fiddling around behind the kernel's back */
-	add_taint(TAINT_USER, LOCKDEP_NOW_UNRELIABLE);
+	add_taint(TAINT_USER);
 
 	snd_soc_write(codec, reg, value);
 	return buf_size;
diff --git a/trunk/tools/testing/ktest/examples/include/patchcheck.conf b/trunk/tools/testing/ktest/examples/include/patchcheck.conf
index 0eb0a5ac77da..339d3e1700ff 100644
--- a/trunk/tools/testing/ktest/examples/include/patchcheck.conf
+++ b/trunk/tools/testing/ktest/examples/include/patchcheck.conf
@@ -14,16 +14,6 @@
 PATCH_START := HEAD~3
 PATCH_END := HEAD
 
-# Use the oldconfig if build_type wasn't defined
-DEFAULTS IF NOT DEFINED BUILD_TYPE
-DO_BUILD_TYPE := oldconfig
-
-DEFAULTS ELSE
-DO_BUILD_TYPE := ${BUILD_TYPE}
-
-DEFAULTS
-
-
 # Change PATCH_CHECKOUT to be the branch you want to test. The test will
 # do a git checkout of this branch before starting. Obviously both
 # PATCH_START and PATCH_END must be in this branch (and PATCH_START must
@@ -53,31 +43,6 @@ PATCH_TEST_TYPE := boot
 # (space delimited)
 #IGNORE_WARNINGS = 39eaf7ef884dcc44f7ff1bac803ca2a1dcf43544 6edb2a8a385f0cdef51dae37ff23e74d76d8a6ce
 
-# Instead of just checking for warnings to files that are changed
-# it can be advantageous to check for any new warnings. If a
-# header file is changed, it could cause a warning in a file not
-# touched by the commit. To detect these kinds of warnings, you
-# can use the WARNINGS_FILE option.
-#
-# If the variable CREATE_WARNINGS_FILE is set, this config will
-# enable the WARNINGS_FILE during the patchcheck test. Also,
-# before running the patchcheck test, it will create the
-# warnings file.
-#
-DEFAULTS IF DEFINED CREATE_WARNINGS_FILE
-WARNINGS_FILE = ${OUTPUT_DIR}/warnings_file
-
-TEST_START IF DEFINED CREATE_WARNINGS_FILE
-# WARNINGS_FILE is already set by the DEFAULTS above
-TEST_TYPE = make_warnings_file
-# Checkout the commit before the patches to test,
-# and record all the warnings that exist before the patches
-# to test are added
-CHECKOUT = ${PATCHCHECK_START}~1
-# Force a full build
-BUILD_NOCLEAN = 0
-BUILD_TYPE = ${DO_BUILD_TYPE}
-
 # If you are running a multi test, and the test failed on the first
 # test but on, say the 5th patch. If you want to restart on the
 # fifth patch, set PATCH_START1. This will make the first test start
@@ -96,7 +61,6 @@ PATCHCHECK_TYPE = ${PATCH_TEST_TYPE}
 PATCHCHECK_START = ${PATCH_START1}
 PATCHCHECK_END = ${PATCH_END}
 CHECKOUT = ${PATCH_CHECKOUT}
-BUILD_TYPE = ${DO_BUILD_TYPE}
 
 TEST_START IF ${TEST} == patchcheck && ${MULTI}
 TEST_TYPE = patchcheck
@@ -108,4 +72,3 @@ PATCHCHECK_END = ${PATCH_END}
 CHECKOUT = ${PATCH_CHECKOUT}
 # Use multi to test different compilers?
 MAKE_CMD = CC=gcc-4.5.1 make
-BUILD_TYPE = ${DO_BUILD_TYPE}
diff --git a/trunk/tools/testing/ktest/ktest.pl b/trunk/tools/testing/ktest/ktest.pl
index 4e67d52eb3a2..35fc584a4ffe 100755
--- a/trunk/tools/testing/ktest/ktest.pl
+++ b/trunk/tools/testing/ktest/ktest.pl
@@ -126,7 +126,6 @@
 my $output_minconfig;
 my $minconfig_type;
 my $use_output_minconfig;
-my $warnings_file;
 my $ignore_config;
 my $ignore_errors;
 my $addconfig;
@@ -194,9 +193,6 @@
 # which would require more options.
 my $buildonly = 1;
 
-# tell build not to worry about warnings, even when WARNINGS_FILE is set
-my $warnings_ok = 0;
-
 # set when creating a new config
 my $newconfig = 0;
 
@@ -239,7 +235,6 @@
     "START_MIN_CONFIG"		=> \$start_minconfig,
     "MIN_CONFIG_TYPE"		=> \$minconfig_type,
     "USE_OUTPUT_MIN_CONFIG"	=> \$use_output_minconfig,
-    "WARNINGS_FILE"		=> \$warnings_file,
     "IGNORE_CONFIG"		=> \$ignore_config,
     "TEST"			=> \$run_test,
     "ADD_CONFIG"		=> \$addconfig,
@@ -623,18 +618,6 @@ sub set_value {
     if ($buildonly && $lvalue =~ /^TEST_TYPE(\[.*\])?$/ && $prvalue ne "build") {
 	# Note if a test is something other than build, then we
 	# will need other manditory options.
-	if ($prvalue ne "install") {
-	    # for bisect, we need to check BISECT_TYPE
-	    if ($prvalue ne "bisect") {
-		$buildonly = 0;
-	    }
-	} else {
-	    # install still limits some manditory options.
-	    $buildonly = 2;
-	}
-    }
-
-    if ($buildonly && $lvalue =~ /^BISECT_TYPE(\[.*\])?$/ && $prvalue ne "build") {
 	if ($prvalue ne "install") {
 	    $buildonly = 0;
 	} else {
@@ -1079,7 +1062,7 @@ sub read_config {
 }
 
 sub __eval_option {
-    my ($name, $option, $i) = @_;
+    my ($option, $i) = @_;
 
     # Add space to evaluate the character before $
     $option = " $option";
@@ -1111,11 +1094,7 @@ sub __eval_option {
 	my $o = "$var\[$i\]";
 	my $parento = "$var\[$parent\]";
 
-	# If a variable contains itself, use the default var
-	if (($var eq $name) && defined($opt{$var})) {
-	    $o = $opt{$var};
-	    $retval = "$retval$o";
-	} elsif (defined($opt{$o})) {
+	if (defined($opt{$o})) {
 	    $o = $opt{$o};
 	    $retval = "$retval$o";
 	} elsif ($repeated && defined($opt{$parento})) {
@@ -1139,7 +1118,7 @@ sub __eval_option {
 }
 
 sub eval_option {
-    my ($name, $option, $i) = @_;
+    my ($option, $i) = @_;
 
     my $prev = "";
 
@@ -1155,7 +1134,7 @@ sub eval_option {
 		"Check for recursive variables\n";
 	}
 	$prev = $option;
-	$option = __eval_option($name, $option, $i);
+	$option = __eval_option($option, $i);
     }
 
     return $option;
@@ -1212,24 +1191,11 @@ sub reboot {
     }
 
     if (defined($time)) {
-
-	# We only want to get to the new kernel, don't fail
-	# if we stumble over a call trace.
-	my $save_ignore_errors = $ignore_errors;
-	$ignore_errors = 1;
-
-	# Look for the good kernel to boot
-	if (wait_for_monitor($time, "Linux version")) {
+	if (wait_for_monitor($time, $reboot_success_line)) {
 	    # reboot got stuck?
 	    doprint "Reboot did not finish. Forcing power cycle\n";
 	    run_command "$power_cycle";
 	}
-
-	$ignore_errors = $save_ignore_errors;
-
-	# Still need to wait for the reboot to finish
-	wait_for_monitor($time, $reboot_success_line);
-
 	end_monitor;
     }
 }
@@ -1313,7 +1279,6 @@ sub start_monitor {
 }
 
 sub end_monitor {
-    return if (!defined $console);
     if (--$monitor_cnt) {
 	return;
     }
@@ -1620,7 +1585,7 @@ sub wait_for_input
 
     $rin = '';
     vec($rin, fileno($fp), 1) = 1;
-    ($ready, $time) = select($rin, undef, undef, $time);
+    $ready = select($rin, undef, undef, $time);
 
     $line = "";
 
@@ -1926,102 +1891,23 @@ sub get_version {
 
 sub start_monitor_and_boot {
     # Make sure the stable kernel has finished booting
-
-    # Install bisects, don't need console
-    if (defined $console) {
-	start_monitor;
-	wait_for_monitor 5;
-	end_monitor;
-    }
+    start_monitor;
+    wait_for_monitor 5;
+    end_monitor;
 
     get_grub_index;
     get_version;
     install;
 
-    start_monitor if (defined $console);
+    start_monitor;
     return monitor;
 }
 
-my $check_build_re = ".*:.*(warning|error|Error):.*";
-my $utf8_quote = "\\x{e2}\\x{80}(\\x{98}|\\x{99})";
-
-sub process_warning_line {
-    my ($line) = @_;
-
-    chomp $line;
-
-    # for distcc heterogeneous systems, some compilers
-    # do things differently causing warning lines
-    # to be slightly different. This makes an attempt
-    # to fixe those issues.
-
-    # chop off the index into the line
-    # using distcc, some compilers give different indexes
-    # depending on white space
-    $line =~ s/^(\s*\S+:\d+:)\d+/$1/;
-
-    # Some compilers use UTF-8 extended for quotes and some don't.
-    $line =~ s/$utf8_quote/'/g;
-
-    return $line;
-}
-
-# Read buildlog and check against warnings file for any
-# new warnings.
-#
-# Returns 1 if OK
-#         0 otherwise
 sub check_buildlog {
-    return 1 if (!defined $warnings_file);
-
-    my %warnings_list;
-
-    # Failed builds should not reboot the target
-    my $save_no_reboot = $no_reboot;
-    $no_reboot = 1;
-
-    if (-f $warnings_file) {
-	open(IN, $warnings_file) or
-	    dodie "Error opening $warnings_file";
-
-	while (<IN>) {
-	    if (/$check_build_re/) {
-		my $warning = process_warning_line $_;
-		
-		$warnings_list{$warning} = 1;
-	    }
-	}
-	close(IN);
-    }
-
-    # If warnings file didn't exist, and WARNINGS_FILE exist,
-    # then we fail on any warning!
-
-    open(IN, $buildlog) or dodie "Can't open $buildlog";
-    while (<IN>) {
-	if (/$check_build_re/) {
-	    my $warning = process_warning_line $_;
-
-	    if (!defined $warnings_list{$warning}) {
-		fail "New warning found (not in $warnings_file)\n$_\n";
-		$no_reboot = $save_no_reboot;
-		return 0;
-	    }
-	}
-    }
-    $no_reboot = $save_no_reboot;
-    close(IN);
-}
-
-sub check_patch_buildlog {
     my ($patch) = @_;
 
     my @files = `git show $patch | diffstat -l`;
 
-    foreach my $file (@files) {
-	chomp $file;
-    }
-
     open(IN, "git show $patch |") or
 	dodie "failed to show $patch";
     while (<IN>) {
@@ -3169,12 +3055,10 @@ sub patchcheck {
 	    build "oldconfig" or return 0;
 	}
 
-	# No need to do per patch checking if warnings file exists
-	if (!defined($warnings_file) && !defined($ignored_warnings{$sha1})) {
-	    check_patch_buildlog $sha1 or return 0;
-	}
 
-	check_buildlog or return 0;
+	if (!defined($ignored_warnings{$sha1})) {
+	    check_buildlog $sha1 or return 0;
+	}
 
 	next if ($type eq "build");
 
@@ -3733,39 +3617,6 @@ sub make_min_config {
     return 1;
 }
 
-sub make_warnings_file {
-    my ($i) = @_;
-
-    if (!defined($warnings_file)) {
-	dodie "Must define WARNINGS_FILE for make_warnings_file test";
-    }
-
-    if ($build_type eq "nobuild") {
-	dodie "BUILD_TYPE can not be 'nobuild' for make_warnings_file test";
-    }
-
-    build $build_type or dodie "Failed to build";
-
-    open(OUT, ">$warnings_file") or dodie "Can't create $warnings_file";
-
-    open(IN, $buildlog) or dodie "Can't open $buildlog";
-    while (<IN>) {
-
-	# Some compilers use UTF-8 extended for quotes
-	# for distcc heterogeneous systems, this causes issues
-	s/$utf8_quote/'/g;
-
-	if (/$check_build_re/) {
-	    print OUT;
-	}
-    }
-    close(IN);
-
-    close(OUT);
-
-    success $i;
-}
-
 $#ARGV < 1 or die "ktest.pl version: $VERSION\n   usage: ktest.pl config-file\n";
 
 if ($#ARGV == 0) {
@@ -3811,7 +3662,7 @@ sub make_warnings_file {
 read_config $ktest_config;
 
 if (defined($opt{"LOG_FILE"})) {
-    $opt{"LOG_FILE"} = eval_option("LOG_FILE", $opt{"LOG_FILE"}, -1);
+    $opt{"LOG_FILE"} = eval_option($opt{"LOG_FILE"}, -1);
 }
 
 # Append any configs entered in manually to the config file.
@@ -3888,7 +3739,7 @@ sub set_test_option {
     my $option = __set_test_option($name, $i);
     return $option if (!defined($option));
 
-    return eval_option($name, $option, $i);
+    return eval_option($option, $i);
 }
 
 # First we need to do is the builds
@@ -3967,9 +3818,9 @@ sub set_test_option {
 	$run_type = $bisect_type;
     } elsif ($test_type eq "config_bisect") {
 	$run_type = $config_bisect_type;
-    } elsif ($test_type eq "make_min_config") {
-	$run_type = "";
-    } elsif ($test_type eq "make_warnings_file") {
+    }
+
+    if ($test_type eq "make_min_config") {
 	$run_type = "";
     }
 
@@ -4026,15 +3877,10 @@ sub set_test_option {
     } elsif ($test_type eq "make_min_config") {
 	make_min_config $i;
 	next;
-    } elsif ($test_type eq "make_warnings_file") {
-	$no_reboot = 1;
-	make_warnings_file $i;
-	next;
     }
 
     if ($build_type ne "nobuild") {
 	build $build_type or next;
-	check_buildlog or next;
     }
 
     if ($test_type eq "install") {
diff --git a/trunk/tools/testing/ktest/sample.conf b/trunk/tools/testing/ktest/sample.conf
index 0a290fb4cd5e..4012e9330344 100644
--- a/trunk/tools/testing/ktest/sample.conf
+++ b/trunk/tools/testing/ktest/sample.conf
@@ -793,20 +793,6 @@
 # Example for a virtual guest call "Guest".
 #POWER_OFF = virsh destroy Guest
 
-# To have the build fail on "new" warnings, create a file that
-# contains a list of all known warnings (they must match exactly
-# to the line with 'warning:', 'error:' or 'Error:'. If the option
-# WARNINGS_FILE is set, then that file will be read, and if the
-# build detects a warning, it will examine this file and if the
-# warning does not exist in it, it will fail the build.
-#
-# Note, if this option is defined to a file that does not exist
-# then any warning will fail the build.
-#  (see make_warnings_file below)
-#
-# (optional, default undefined)
-#WARNINGS_FILE = ${OUTPUT_DIR}/warnings_file
-
 # The way to execute a command on the target
 # (default ssh $SSH_USER@$MACHINE $SSH_COMMAND";)
 # The variables SSH_USER, MACHINE and SSH_COMMAND are defined
@@ -1236,33 +1222,3 @@
 #  MIN_CONFIG_TYPE = test
 #  TEST = ssh ${USER}@${MACHINE} echo hi
 #
-#
-#
-#
-# For TEST_TYPE = make_warnings_file
-#
-# If you want the build to fail when a new warning is discovered
-# you set the WARNINGS_FILE to point to a file of known warnings.
-#
-# The test "make_warnings_file" will let you create a new warnings
-# file before you run other tests, like patchcheck.
-#
-# What this test does is to run just a build, you still need to
-# specify BUILD_TYPE to tell the test what type of config to use.
-# A BUILD_TYPE of nobuild will fail this test.
-#
-# The test will do the build and scan for all warnings. Any warning
-# it discovers will be saved in the WARNINGS_FILE (required) option.
-#
-# It is recommended (but not necessary) to make sure BUILD_NOCLEAN is
-# off, so that a full build is done (make mrproper is performed).
-# That way, all warnings will be captured.
-#
-# Example:
-#
-#  TEST_TYPE = make_warnings_file
-#  WARNINGS_FILE = ${OUTPUT_DIR}
-#  BUILD_TYPE = useconfig:oldconfig
-#  CHECKOUT = v3.8
-#  BUILD_NOCLEAN = 0
-#