7 files changed, 304 insertions, 200 deletions

diff --git a/Documentation/RCU/RTFP.txt b/Documentation/RCU/RTFP.txt
index 7c1dfb19fc40..7f40c72a9c51 100644
--- a/Documentation/RCU/RTFP.txt
+++ b/Documentation/RCU/RTFP.txt
@@ -186,7 +186,7 @@ Bibtex Entries
 
 @article{Kung80
 ,author="H. T. Kung and Q. Lehman"
-,title="Concurrent Maintenance of Binary Search Trees"
+,title="Concurrent Manipulation of Binary Search Trees"
 ,Year="1980"
 ,Month="September"
 ,journal="ACM Transactions on Database Systems"
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index cdb20d41a44a..31ef8fe07f82 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -271,15 +271,14 @@ over a rather long period of time, but improvements are always welcome!
         The same cautions apply to call_rcu_bh() and call_rcu_sched().
 
 9.      All RCU list-traversal primitives, which include
-        rcu_dereference(), list_for_each_entry_rcu(),
-        list_for_each_continue_rcu(), and list_for_each_safe_rcu(),
-        must be either within an RCU read-side critical section or
-        must be protected by appropriate update-side locks.  RCU
-        read-side critical sections are delimited by rcu_read_lock()
-        and rcu_read_unlock(), or by similar primitives such as
-        rcu_read_lock_bh() and rcu_read_unlock_bh(), in which case
-        the matching rcu_dereference() primitive must be used in order
-        to keep lockdep happy, in this case, rcu_dereference_bh().
+        rcu_dereference(), list_for_each_entry_rcu(), and
+        list_for_each_safe_rcu(), must be either within an RCU read-side
+        critical section or must be protected by appropriate update-side
+        locks.  RCU read-side critical sections are delimited by
+        rcu_read_lock() and rcu_read_unlock(), or by similar primitives
+        such as rcu_read_lock_bh() and rcu_read_unlock_bh(), in which
+        case the matching rcu_dereference() primitive must be used in
+        order to keep lockdep happy, in this case, rcu_dereference_bh().
 
         The reason that it is permissible to use RCU list-traversal
         primitives when the update-side lock is held is that doing so
diff --git a/Documentation/RCU/listRCU.txt b/Documentation/RCU/listRCU.txt
index 4349c1487e91..adb5a3782846 100644
--- a/Documentation/RCU/listRCU.txt
+++ b/Documentation/RCU/listRCU.txt
@@ -205,7 +205,7 @@ RCU ("read-copy update") its name.  The RCU code is as follows:
                                 audit_copy_rule(&ne->rule, &e->rule);
                                 ne->rule.action = newaction;
                                 ne->rule.file_count = newfield_count;
-                                list_replace_rcu(e, ne);
+                                list_replace_rcu(&e->list, &ne->list);
                                 call_rcu(&e->rcu, audit_free_rule);
                                 return 0;
                         }
diff --git a/Documentation/RCU/rcuref.txt b/Documentation/RCU/rcuref.txt
index 4202ad093130..141d531aa14b 100644
--- a/Documentation/RCU/rcuref.txt
+++ b/Documentation/RCU/rcuref.txt
@@ -20,7 +20,7 @@ release_referenced()			delete()
 {                                       {
     ...                                     write_lock(&list_lock);
     atomic_dec(&el->rc, relfunc)            ...
-    ...                                     delete_element
+    ...                                     remove_element
 }                                           write_unlock(&list_lock);
                                             ...
                                             if (atomic_dec_and_test(&el->rc))
@@ -52,7 +52,7 @@ release_referenced()			delete()
 {                                       {
     ...                                     spin_lock(&list_lock);
     if (atomic_dec_and_test(&el->rc))       ...
-        call_rcu(&el->head, el_free);       delete_element
+        call_rcu(&el->head, el_free);       remove_element
     ...                                     spin_unlock(&list_lock);
 }                                           ...
                                             if (atomic_dec_and_test(&el->rc))
@@ -64,3 +64,60 @@ Sometimes, a reference to the element needs to be obtained in the
 update (write) stream.  In such cases, atomic_inc_not_zero() might be
 overkill, since we hold the update-side spinlock.  One might instead
 use atomic_inc() in such cases.
+
+It is not always convenient to deal with "FAIL" in the
+search_and_reference() code path.  In such cases, the
+atomic_dec_and_test() may be moved from delete() to el_free()
+as follows:
+
+1.                                      2.
+add()                                   search_and_reference()
+{                                       {
+    alloc_object                            rcu_read_lock();
+    ...                                     search_for_element
+    atomic_set(&el->rc, 1);                 atomic_inc(&el->rc);
+    spin_lock(&list_lock);                  ...
+
+    add_element                             rcu_read_unlock();
+    ...                                 }
+    spin_unlock(&list_lock);            4.
+}                                       delete()
+3.                                      {
+release_referenced()                        spin_lock(&list_lock);
+{                                           ...
+    ...                                     remove_element
+    if (atomic_dec_and_test(&el->rc))       spin_unlock(&list_lock);
+        kfree(el);                          ...
+    ...                                     call_rcu(&el->head, el_free);
+}                                           ...
+5.                                      }
+void el_free(struct rcu_head *rhp)
+{
+    release_referenced();
+}
+
+The key point is that the initial reference added by add() is not removed
+until after a grace period has elapsed following removal.  This means that
+search_and_reference() cannot find this element, which means that the value
+of el->rc cannot increase.  Thus, once it reaches zero, there are no
+readers that can or ever will be able to reference the element.  The
+element can therefore safely be freed.  This in turn guarantees that if
+any reader finds the element, that reader may safely acquire a reference
+without checking the value of the reference counter.
+
+In cases where delete() can sleep, synchronize_rcu() can be called from
+delete(), so that el_free() can be subsumed into delete as follows:
+
+4.
+delete()
+{
+    spin_lock(&list_lock);
+    ...
+    remove_element
+    spin_unlock(&list_lock);
+    ...
+    synchronize_rcu();
+    if (atomic_dec_and_test(&el->rc))
+        kfree(el);
+    ...
+}
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
index 672d19083252..c776968f4463 100644
--- a/Documentation/RCU/trace.txt
+++ b/Documentation/RCU/trace.txt
@@ -10,51 +10,63 @@ for rcutree and next for rcutiny.
 
 CONFIG_TREE_RCU and CONFIG_TREE_PREEMPT_RCU debugfs Files and Formats
 
-These implementations of RCU provides several debugfs files under the
+These implementations of RCU provide several debugfs directories under the
 top-level directory "rcu":
 
-rcu/rcudata:
+rcu/rcu_bh
+rcu/rcu_preempt
+rcu/rcu_sched
+
+Each directory contains files for the corresponding flavor of RCU.
+Note that rcu/rcu_preempt is only present for CONFIG_TREE_PREEMPT_RCU.
+For CONFIG_TREE_RCU, the RCU flavor maps onto the RCU-sched flavor,
+so that activity for both appears in rcu/rcu_sched.
+
+In addition, the following file appears in the top-level directory:
+rcu/rcutorture.  This file displays rcutorture test progress.  The output
+of "cat rcu/rcutorture" looks as follows:
+
+rcutorture test sequence: 0 (test in progress)
+rcutorture update version number: 615
+
+The first line shows the number of rcutorture tests that have completed
+since boot.  If a test is currently running, the "(test in progress)"
+string will appear as shown above.  The second line shows the number of
+update cycles that the current test has started, or zero if there is
+no test in progress.
+
+
+Within each flavor directory (rcu/rcu_bh, rcu/rcu_sched, and possibly
+also rcu/rcu_preempt) the following files will be present:
+
+rcudata:
         Displays fields in struct rcu_data.
-rcu/rcudata.csv:
-        Comma-separated values spreadsheet version of rcudata.
-rcu/rcugp:
+rcuexp:
+        Displays statistics for expedited grace periods.
+rcugp:
         Displays grace-period counters.
-rcu/rcuhier:
+rcuhier:
         Displays the struct rcu_node hierarchy.
-rcu/rcu_pending:
+rcu_pending:
         Displays counts of the reasons rcu_pending() decided that RCU had
         work to do.
-rcu/rcutorture:
-        Displays rcutorture test progress.
-rcu/rcuboost:
+rcuboost:
         Displays RCU boosting statistics.  Only present if
         CONFIG_RCU_BOOST=y.
 
-The output of "cat rcu/rcudata" looks as follows:
-
-rcu_sched:
-  0 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=545/1/0 df=50 of=0 ql=163 qs=NRW. kt=0/W/0 ktl=ebc3 b=10 ci=153737 co=0 ca=0
-  1 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=967/1/0 df=58 of=0 ql=634 qs=NRW. kt=0/W/1 ktl=58c b=10 ci=191037 co=0 ca=0
-  2 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=1081/1/0 df=175 of=0 ql=74 qs=N.W. kt=0/W/2 ktl=da94 b=10 ci=75991 co=0 ca=0
-  3 c=20942 g=20943 pq=1 pgp=20942 qp=1 dt=1846/0/0 df=404 of=0 ql=0 qs=.... kt=0/W/3 ktl=d1cd b=10 ci=72261 co=0 ca=0
-  4 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=369/1/0 df=83 of=0 ql=48 qs=N.W. kt=0/W/4 ktl=e0e7 b=10 ci=128365 co=0 ca=0
-  5 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=381/1/0 df=64 of=0 ql=169 qs=NRW. kt=0/W/5 ktl=fb2f b=10 ci=164360 co=0 ca=0
-  6 c=20972 g=20973 pq=1 pgp=20973 qp=0 dt=1037/1/0 df=183 of=0 ql=62 qs=N.W. kt=0/W/6 ktl=d2ad b=10 ci=65663 co=0 ca=0
-  7 c=20897 g=20897 pq=1 pgp=20896 qp=0 dt=1572/0/0 df=382 of=0 ql=0 qs=.... kt=0/W/7 ktl=cf15 b=10 ci=75006 co=0 ca=0
-rcu_bh:
-  0 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=545/1/0 df=6 of=0 ql=0 qs=.... kt=0/W/0 ktl=ebc3 b=10 ci=0 co=0 ca=0
-  1 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=967/1/0 df=3 of=0 ql=0 qs=.... kt=0/W/1 ktl=58c b=10 ci=151 co=0 ca=0
-  2 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=1081/1/0 df=6 of=0 ql=0 qs=.... kt=0/W/2 ktl=da94 b=10 ci=0 co=0 ca=0
-  3 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=1846/0/0 df=8 of=0 ql=0 qs=.... kt=0/W/3 ktl=d1cd b=10 ci=0 co=0 ca=0
-  4 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=369/1/0 df=6 of=0 ql=0 qs=.... kt=0/W/4 ktl=e0e7 b=10 ci=0 co=0 ca=0
-  5 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=381/1/0 df=4 of=0 ql=0 qs=.... kt=0/W/5 ktl=fb2f b=10 ci=0 co=0 ca=0
-  6 c=1480 g=1480 pq=1 pgp=1480 qp=0 dt=1037/1/0 df=6 of=0 ql=0 qs=.... kt=0/W/6 ktl=d2ad b=10 ci=0 co=0 ca=0
-  7 c=1474 g=1474 pq=1 pgp=1473 qp=0 dt=1572/0/0 df=8 of=0 ql=0 qs=.... kt=0/W/7 ktl=cf15 b=10 ci=0 co=0 ca=0
-
-The first section lists the rcu_data structures for rcu_sched, the second
-for rcu_bh.  Note that CONFIG_TREE_PREEMPT_RCU kernels will have an
-additional section for rcu_preempt.  Each section has one line per CPU,
-or eight for this 8-CPU system.  The fields are as follows:
+The output of "cat rcu/rcu_preempt/rcudata" looks as follows:
+
+  0!c=30455 g=30456 pq=1 qp=1 dt=126535/140000000000000/0 df=2002 of=4 ql=0/0 qs=N... b=10 ci=74572 nci=0 co=1131 ca=716
+  1!c=30719 g=30720 pq=1 qp=0 dt=132007/140000000000000/0 df=1874 of=10 ql=0/0 qs=N... b=10 ci=123209 nci=0 co=685 ca=982
+  2!c=30150 g=30151 pq=1 qp=1 dt=138537/140000000000000/0 df=1707 of=8 ql=0/0 qs=N... b=10 ci=80132 nci=0 co=1328 ca=1458
+  3 c=31249 g=31250 pq=1 qp=0 dt=107255/140000000000000/0 df=1749 of=6 ql=0/450 qs=NRW. b=10 ci=151700 nci=0 co=509 ca=622
+  4!c=29502 g=29503 pq=1 qp=1 dt=83647/140000000000000/0 df=965 of=5 ql=0/0 qs=N... b=10 ci=65643 nci=0 co=1373 ca=1521
+  5 c=31201 g=31202 pq=1 qp=1 dt=70422/0/0 df=535 of=7 ql=0/0 qs=.... b=10 ci=58500 nci=0 co=764 ca=698
+  6!c=30253 g=30254 pq=1 qp=1 dt=95363/140000000000000/0 df=780 of=5 ql=0/0 qs=N... b=10 ci=100607 nci=0 co=1414 ca=1353
+  7 c=31178 g=31178 pq=1 qp=0 dt=91536/0/0 df=547 of=4 ql=0/0 qs=.... b=10 ci=109819 nci=0 co=1115 ca=969
+
+This file has one line per CPU, or eight for this 8-CPU system.
+The fields are as follows:
 
 o       The number at the beginning of each line is the CPU number.
         CPUs numbers followed by an exclamation mark are offline,
@@ -64,11 +76,13 @@ o	The number at the beginning of each line is the CPU number.
         substantially larger than the number of actual CPUs.
 
 o       "c" is the count of grace periods that this CPU believes have
-        completed.  Offlined CPUs and CPUs in dynticks idle mode may
-        lag quite a ways behind, for example, CPU 6 under "rcu_sched"
-        above, which has been offline through not quite 40,000 RCU grace
-        periods.  It is not unusual to see CPUs lagging by thousands of
-        grace periods.
+        completed.  Offlined CPUs and CPUs in dynticks idle mode may lag
+        quite a ways behind, for example, CPU 4 under "rcu_sched" above,
+        which has been offline through 16 RCU grace periods.  It is not
+        unusual to see offline CPUs lagging by thousands of grace periods.
+        Note that although the grace-period number is an unsigned long,
+        it is printed out as a signed long to allow more human-friendly
+        representation near boot time.
 
 o       "g" is the count of grace periods that this CPU believes have
         started.  Again, offlined CPUs and CPUs in dynticks idle mode
@@ -84,30 +98,25 @@ o	"pq" indicates that this CPU has passed through a quiescent state
         CPU has not yet reported that fact, (2) some other CPU has not
         yet reported for this grace period, or (3) both.
 
-o       "pgp" indicates which grace period the last-observed quiescent
-        state for this CPU corresponds to.  This is important for handling
-        the race between CPU 0 reporting an extended dynticks-idle
-        quiescent state for CPU 1 and CPU 1 suddenly waking up and
-        reporting its own quiescent state.  If CPU 1 was the last CPU
-        for the current grace period, then the CPU that loses this race
-        will attempt to incorrectly mark CPU 1 as having checked in for
-        the next grace period!
-
 o       "qp" indicates that RCU still expects a quiescent state from
         this CPU.  Offlined CPUs and CPUs in dyntick idle mode might
         well have qp=1, which is OK: RCU is still ignoring them.
 
 o       "dt" is the current value of the dyntick counter that is incremented
-        when entering or leaving dynticks idle state, either by the
-        scheduler or by irq.  This number is even if the CPU is in
-        dyntick idle mode and odd otherwise.  The number after the first
-        "/" is the interrupt nesting depth when in dyntick-idle state,
-        or one greater than the interrupt-nesting depth otherwise.
-        The number after the second "/" is the NMI nesting depth.
+        when entering or leaving idle, either due to a context switch or
+        due to an interrupt.  This number is even if the CPU is in idle
+        from RCU's viewpoint and odd otherwise.  The number after the
+        first "/" is the interrupt nesting depth when in idle state,
+        or a large number added to the interrupt-nesting depth when
+        running a non-idle task.  Some architectures do not accurately
+        count interrupt nesting when running in non-idle kernel context,
+        which can result in interesting anomalies such as negative
+        interrupt-nesting levels.  The number after the second "/"
+        is the NMI nesting depth.
 
 o       "df" is the number of times that some other CPU has forced a
         quiescent state on behalf of this CPU due to this CPU being in
-        dynticks-idle state.
+        idle state.
 
 o       "of" is the number of times that some other CPU has forced a
         quiescent state on behalf of this CPU due to this CPU being
@@ -120,9 +129,13 @@ o	"of" is the number of times that some other CPU has forced a
         error, so it makes sense to err conservatively.
 
 o       "ql" is the number of RCU callbacks currently residing on
-        this CPU.  This is the total number of callbacks, regardless
-        of what state they are in (new, waiting for grace period to
-        start, waiting for grace period to end, ready to invoke).
+        this CPU.  The first number is the number of "lazy" callbacks
+        that are known to RCU to only be freeing memory, and the number
+        after the "/" is the total number of callbacks, lazy or not.
+        These counters count callbacks regardless of what phase of
+        grace-period processing that they are in (new, waiting for
+        grace period to start, waiting for grace period to end, ready
+        to invoke).
 
 o       "qs" gives an indication of the state of the callback queue
         with four characters:
@@ -150,6 +163,43 @@ o	"qs" gives an indication of the state of the callback queue
         If there are no callbacks in a given one of the above states,
         the corresponding character is replaced by ".".
 
+o       "b" is the batch limit for this CPU.  If more than this number
+        of RCU callbacks is ready to invoke, then the remainder will
+        be deferred.
+
+o       "ci" is the number of RCU callbacks that have been invoked for
+        this CPU.  Note that ci+nci+ql is the number of callbacks that have
+        been registered in absence of CPU-hotplug activity.
+
+o       "nci" is the number of RCU callbacks that have been offloaded from
+        this CPU.  This will always be zero unless the kernel was built
+        with CONFIG_RCU_NOCB_CPU=y and the "rcu_nocbs=" kernel boot
+        parameter was specified.
+
+o       "co" is the number of RCU callbacks that have been orphaned due to
+        this CPU going offline.  These orphaned callbacks have been moved
+        to an arbitrarily chosen online CPU.
+
+o       "ca" is the number of RCU callbacks that have been adopted by this
+        CPU due to other CPUs going offline.  Note that ci+co-ca+ql is
+        the number of RCU callbacks registered on this CPU.
+
+
+Kernels compiled with CONFIG_RCU_BOOST=y display the following from
+/debug/rcu/rcu_preempt/rcudata:
+
+  0!c=12865 g=12866 pq=1 qp=1 dt=83113/140000000000000/0 df=288 of=11 ql=0/0 qs=N... kt=0/O ktl=944 b=10 ci=60709 nci=0 co=748 ca=871
+  1 c=14407 g=14408 pq=1 qp=0 dt=100679/140000000000000/0 df=378 of=7 ql=0/119 qs=NRW. kt=0/W ktl=9b6 b=10 ci=109740 nci=0 co=589 ca=485
+  2 c=14407 g=14408 pq=1 qp=0 dt=105486/0/0 df=90 of=9 ql=0/89 qs=NRW. kt=0/W ktl=c0c b=10 ci=83113 nci=0 co=533 ca=490
+  3 c=14407 g=14408 pq=1 qp=0 dt=107138/0/0 df=142 of=8 ql=0/188 qs=NRW. kt=0/W ktl=b96 b=10 ci=121114 nci=0 co=426 ca=290
+  4 c=14405 g=14406 pq=1 qp=1 dt=50238/0/0 df=706 of=7 ql=0/0 qs=.... kt=0/W ktl=812 b=10 ci=34929 nci=0 co=643 ca=114
+  5!c=14168 g=14169 pq=1 qp=0 dt=45465/140000000000000/0 df=161 of=11 ql=0/0 qs=N... kt=0/O ktl=b4d b=10 ci=47712 nci=0 co=677 ca=722
+  6 c=14404 g=14405 pq=1 qp=0 dt=59454/0/0 df=94 of=6 ql=0/0 qs=.... kt=0/W ktl=e57 b=10 ci=55597 nci=0 co=701 ca=811
+  7 c=14407 g=14408 pq=1 qp=1 dt=68850/0/0 df=31 of=8 ql=0/0 qs=.... kt=0/W ktl=14bd b=10 ci=77475 nci=0 co=508 ca=1042
+
+This is similar to the output discussed above, but contains the following
+additional fields:
+
 o       "kt" is the per-CPU kernel-thread state.  The digit preceding
         the first slash is zero if there is no work pending and 1
         otherwise.  The character between the first pair of slashes is
@@ -184,35 +234,51 @@ o	"ktl" is the low-order 16 bits (in hexadecimal) of the count of
 
         This field is displayed only for CONFIG_RCU_BOOST kernels.
 
-o       "b" is the batch limit for this CPU.  If more than this number
-        of RCU callbacks is ready to invoke, then the remainder will
-        be deferred.
 
-o       "ci" is the number of RCU callbacks that have been invoked for
-        this CPU.  Note that ci+ql is the number of callbacks that have
-        been registered in absence of CPU-hotplug activity.
+The output of "cat rcu/rcu_preempt/rcuexp" looks as follows:
 
-o       "co" is the number of RCU callbacks that have been orphaned due to
-        this CPU going offline.  These orphaned callbacks have been moved
-        to an arbitrarily chosen online CPU.
+s=21872 d=21872 w=0 tf=0 wd1=0 wd2=0 n=0 sc=21872 dt=21872 dl=0 dx=21872
+
+These fields are as follows:
+
+o       "s" is the starting sequence number.
 
-o       "ca" is the number of RCU callbacks that have been adopted due to
-        other CPUs going offline.  Note that ci+co-ca+ql is the number of
-        RCU callbacks registered on this CPU.
+o       "d" is the ending sequence number.  When the starting and ending
+        numbers differ, there is an expedited grace period in progress.
 
-There is also an rcu/rcudata.csv file with the same information in
-comma-separated-variable spreadsheet format.
+o       "w" is the number of times that the sequence numbers have been
+        in danger of wrapping.
 
+o       "tf" is the number of times that contention has resulted in a
+        failure to begin an expedited grace period.
 
-The output of "cat rcu/rcugp" looks as follows:
+o       "wd1" and "wd2" are the number of times that an attempt to
+        start an expedited grace period found that someone else had
+        completed an expedited grace period that satisfies the
+        attempted request.  "Our work is done."
 
-rcu_sched: completed=33062  gpnum=33063
-rcu_bh: completed=464  gpnum=464
+o       "n" is number of times that contention was so great that
+        the request was demoted from an expedited grace period to
+        a normal grace period.
+
+o       "sc" is the number of times that the attempt to start a
+        new expedited grace period succeeded.
+
+o       "dt" is the number of times that we attempted to update
+        the "d" counter.
+
+o       "dl" is the number of times that we failed to update the "d"
+        counter.
+
+o       "dx" is the number of times that we succeeded in updating
+        the "d" counter.
 
-Again, this output is for both "rcu_sched" and "rcu_bh".  Note that
-kernels built with CONFIG_TREE_PREEMPT_RCU will have an additional
-"rcu_preempt" line.  The fields are taken from the rcu_state structure,
-and are as follows:
+
+The output of "cat rcu/rcu_preempt/rcugp" looks as follows:
+
+completed=31249  gpnum=31250  age=1  max=18
+
+These fields are taken from the rcu_state structure, and are as follows:
 
 o       "completed" is the number of grace periods that have completed.
         It is comparable to the "c" field from rcu/rcudata in that a
@@ -220,44 +286,42 @@ o	"completed" is the number of grace periods that have completed.
         that the corresponding RCU grace period has completed.
 
 o       "gpnum" is the number of grace periods that have started.  It is
-        comparable to the "g" field from rcu/rcudata in that a CPU
-        whose "g" field matches the value of "gpnum" is aware that the
-        corresponding RCU grace period has started.
+        similarly comparable to the "g" field from rcu/rcudata in that
+        a CPU whose "g" field matches the value of "gpnum" is aware that
+        the corresponding RCU grace period has started.
+
+        If these two fields are equal, then there is no grace period
+        in progress, in other words, RCU is idle.  On the other hand,
+        if the two fields differ (as they are above), then an RCU grace
+        period is in progress.
 
-        If these two fields are equal (as they are for "rcu_bh" above),
-        then there is no grace period in progress, in other words, RCU
-        is idle.  On the other hand, if the two fields differ (as they
-        do for "rcu_sched" above), then an RCU grace period is in progress.
+o       "age" is the number of jiffies that the current grace period
+        has extended for, or zero if there is no grace period currently
+        in effect.
 
+o       "max" is the age in jiffies of the longest-duration grace period
+        thus far.
 
-The output of "cat rcu/rcuhier" looks as follows, with very long lines:
+The output of "cat rcu/rcu_preempt/rcuhier" looks as follows:
 
-c=6902 g=6903 s=2 jfq=3 j=72c7 nfqs=13142/nfqsng=0(13142) fqlh=6
-1/1 ..>. 0:127 ^0
-3/3 ..>. 0:35 ^0    0/0 ..>. 36:71 ^1    0/0 ..>. 72:107 ^2    0/0 ..>. 108:127 ^3
-3/3f ..>. 0:5 ^0    2/3 ..>. 6:11 ^1    0/0 ..>. 12:17 ^2    0/0 ..>. 18:23 ^3    0/0 ..>. 24:29 ^4    0/0 ..>. 30:35 ^5    0/0 ..>. 36:41 ^0    0/0 ..>. 42:47 ^1    0/0 ..>. 48:53 ^2    0/0 ..>. 54:59 ^3    0/0 ..>. 60:65 ^4    0/0 ..>. 66:71 ^5    0/0 ..>. 72:77 ^0    0/0 ..>. 78:83 ^1    0/0 ..>. 84:89 ^2    0/0 ..>. 90:95 ^3    0/0 ..>. 96:101 ^4    0/0 ..>. 102:107 ^5    0/0 ..>. 108:113 ^0    0/0 ..>. 114:119 ^1    0/0 ..>. 120:125 ^2    0/0 ..>. 126:127 ^3
-rcu_bh:
-c=-226 g=-226 s=1 jfq=-5701 j=72c7 nfqs=88/nfqsng=0(88) fqlh=0
-0/1 ..>. 0:127 ^0
-0/3 ..>. 0:35 ^0    0/0 ..>. 36:71 ^1    0/0 ..>. 72:107 ^2    0/0 ..>. 108:127 ^3
-0/3f ..>. 0:5 ^0    0/3 ..>. 6:11 ^1    0/0 ..>. 12:17 ^2    0/0 ..>. 18:23 ^3    0/0 ..>. 24:29 ^4    0/0 ..>. 30:35 ^5    0/0 ..>. 36:41 ^0    0/0 ..>. 42:47 ^1    0/0 ..>. 48:53 ^2    0/0 ..>. 54:59 ^3    0/0 ..>. 60:65 ^4    0/0 ..>. 66:71 ^5    0/0 ..>. 72:77 ^0    0/0 ..>. 78:83 ^1    0/0 ..>. 84:89 ^2    0/0 ..>. 90:95 ^3    0/0 ..>. 96:101 ^4    0/0 ..>. 102:107 ^5    0/0 ..>. 108:113 ^0    0/0 ..>. 114:119 ^1    0/0 ..>. 120:125 ^2    0/0 ..>. 126:127 ^3
+c=14407 g=14408 s=0 jfq=2 j=c863 nfqs=12040/nfqsng=0(12040) fqlh=1051 oqlen=0/0
+3/3 ..>. 0:7 ^0
+e/e ..>. 0:3 ^0    d/d ..>. 4:7 ^1
 
-This is once again split into "rcu_sched" and "rcu_bh" portions,
-and CONFIG_TREE_PREEMPT_RCU kernels will again have an additional
-"rcu_preempt" section.  The fields are as follows:
+The fields are as follows:
 
-o       "c" is exactly the same as "completed" under rcu/rcugp.
+o       "c" is exactly the same as "completed" under rcu/rcu_preempt/rcugp.
 
-o       "g" is exactly the same as "gpnum" under rcu/rcugp.
+o       "g" is exactly the same as "gpnum" under rcu/rcu_preempt/rcugp.
 
-o       "s" is the "signaled" state that drives force_quiescent_state()'s
+o       "s" is the current state of the force_quiescent_state()
         state machine.
 
 o       "jfq" is the number of jiffies remaining for this grace period
         before force_quiescent_state() is invoked to help push things
-        along.  Note that CPUs in dyntick-idle mode throughout the grace
-        period will not report on their own, but rather must be check by
-        some other CPU via force_quiescent_state().
+        along.  Note that CPUs in idle mode throughout the grace period
+        will not report on their own, but rather must be check by some
+        other CPU via force_quiescent_state().
 
 o       "j" is the low-order four hex digits of the jiffies counter.
         Yes, Paul did run into a number of problems that turned out to
@@ -268,7 +332,8 @@ o	"nfqs" is the number of calls to force_quiescent_state() since
 
 o       "nfqsng" is the number of useless calls to force_quiescent_state(),
         where there wasn't actually a grace period active.  This can
-        happen due to races.  The number in parentheses is the difference
+        no longer happen due to grace-period processing being pushed
+        into a kthread.  The number in parentheses is the difference
         between "nfqs" and "nfqsng", or the number of times that
         force_quiescent_state() actually did some real work.
 
@@ -276,28 +341,27 @@ o	"fqlh" is the number of calls to force_quiescent_state() that
         exited immediately (without even being counted in nfqs above)
         due to contention on ->fqslock.
 
-o       Each element of the form "1/1 0:127 ^0" represents one struct
-        rcu_node.  Each line represents one level of the hierarchy, from
-        root to leaves.  It is best to think of the rcu_data structures
-        as forming yet another level after the leaves.  Note that there
-        might be either one, two, or three levels of rcu_node structures,
-        depending on the relationship between CONFIG_RCU_FANOUT and
-        CONFIG_NR_CPUS.
+o       Each element of the form "3/3 ..>. 0:7 ^0" represents one rcu_node
+        structure.  Each line represents one level of the hierarchy,
+        from root to leaves.  It is best to think of the rcu_data
+        structures as forming yet another level after the leaves.
+        Note that there might be either one, two, three, or even four
+        levels of rcu_node structures, depending on the relationship
+        between CONFIG_RCU_FANOUT, CONFIG_RCU_FANOUT_LEAF (possibly
+        adjusted using the rcu_fanout_leaf kernel boot parameter), and
+        CONFIG_NR_CPUS (possibly adjusted using the nr_cpu_ids count of
+        possible CPUs for the booting hardware).
 
         o       The numbers separated by the "/" are the qsmask followed
                 by the qsmaskinit.  The qsmask will have one bit
-                set for each entity in the next lower level that
-                has not yet checked in for the current grace period.
+                set for each entity in the next lower level that has
+                not yet checked in for the current grace period ("e"
+                indicating CPUs 5, 6, and 7 in the example above).
                 The qsmaskinit will have one bit for each entity that is
                 currently expected to check in during each grace period.
                 The value of qsmaskinit is assigned to that of qsmask
                 at the beginning of each grace period.
 
-                For example, for "rcu_sched", the qsmask of the first
-                entry of the lowest level is 0x14, meaning that we
-                are still waiting for CPUs 2 and 4 to check in for the
-                current grace period.
-
         o       The characters separated by the ">" indicate the state
                 of the blocked-tasks lists.  A "G" preceding the ">"
                 indicates that at least one task blocked in an RCU
@@ -312,48 +376,39 @@ o	Each element of the form "1/1 0:127 ^0" represents one struct
                 A "." character appears if the corresponding condition
                 does not hold, so that "..>." indicates that no tasks
                 are blocked.  In contrast, "GE>T" indicates maximal
-                inconvenience from blocked tasks.
+                inconvenience from blocked tasks.  CONFIG_TREE_RCU
+                builds of the kernel will always show "..>.".
 
         o       The numbers separated by the ":" are the range of CPUs
                 served by this struct rcu_node.  This can be helpful
                 in working out how the hierarchy is wired together.
 
-                For example, the first entry at the lowest level shows
-                "0:5", indicating that it covers CPUs 0 through 5.
+                For example, the example rcu_node structure shown above
+                has "0:7", indicating that it covers CPUs 0 through 7.
 
         o       The number after the "^" indicates the bit in the
-                next higher level rcu_node structure that this
-                rcu_node structure corresponds to.
-
-                For example, the first entry at the lowest level shows
-                "^0", indicating that it corresponds to bit zero in
-                the first entry at the middle level.
-
-
-The output of "cat rcu/rcu_pending" looks as follows:
-
-rcu_sched:
-  0 np=255892 qsp=53936 rpq=85 cbr=0 cng=14417 gpc=10033 gps=24320 nn=146741
-  1 np=261224 qsp=54638 rpq=33 cbr=0 cng=25723 gpc=16310 gps=2849 nn=155792
-  2 np=237496 qsp=49664 rpq=23 cbr=0 cng=2762 gpc=45478 gps=1762 nn=136629
-  3 np=236249 qsp=48766 rpq=98 cbr=0 cng=286 gpc=48049 gps=1218 nn=137723
-  4 np=221310 qsp=46850 rpq=7 cbr=0 cng=26 gpc=43161 gps=4634 nn=123110
-  5 np=237332 qsp=48449 rpq=9 cbr=0 cng=54 gpc=47920 gps=3252 nn=137456
-  6 np=219995 qsp=46718 rpq=12 cbr=0 cng=50 gpc=42098 gps=6093 nn=120834
-  7 np=249893 qsp=49390 rpq=42 cbr=0 cng=72 gpc=38400 gps=17102 nn=144888
-rcu_bh:
-  0 np=146741 qsp=1419 rpq=6 cbr=0 cng=6 gpc=0 gps=0 nn=145314
-  1 np=155792 qsp=12597 rpq=3 cbr=0 cng=0 gpc=4 gps=8 nn=143180
-  2 np=136629 qsp=18680 rpq=1 cbr=0 cng=0 gpc=7 gps=6 nn=117936
-  3 np=137723 qsp=2843 rpq=0 cbr=0 cng=0 gpc=10 gps=7 nn=134863
-  4 np=123110 qsp=12433 rpq=0 cbr=0 cng=0 gpc=4 gps=2 nn=110671
-  5 np=137456 qsp=4210 rpq=1 cbr=0 cng=0 gpc=6 gps=5 nn=133235
-  6 np=120834 qsp=9902 rpq=2 cbr=0 cng=0 gpc=6 gps=3 nn=110921
-  7 np=144888 qsp=26336 rpq=0 cbr=0 cng=0 gpc=8 gps=2 nn=118542
-
-As always, this is once again split into "rcu_sched" and "rcu_bh"
-portions, with CONFIG_TREE_PREEMPT_RCU kernels having an additional
-"rcu_preempt" section.  The fields are as follows:
+                next higher level rcu_node structure that this rcu_node
+                structure corresponds to.  For example, the "d/d ..>. 4:7
+                ^1" has a "1" in this position, indicating that it
+                corresponds to the "1" bit in the "3" shown in the
+                "3/3 ..>. 0:7 ^0" entry on the next level up.
+
+
+The output of "cat rcu/rcu_sched/rcu_pending" looks as follows:
+
+  0!np=26111 qsp=29 rpq=5386 cbr=1 cng=570 gpc=3674 gps=577 nn=15903
+  1!np=28913 qsp=35 rpq=6097 cbr=1 cng=448 gpc=3700 gps=554 nn=18113
+  2!np=32740 qsp=37 rpq=6202 cbr=0 cng=476 gpc=4627 gps=546 nn=20889
+  3 np=23679 qsp=22 rpq=5044 cbr=1 cng=415 gpc=3403 gps=347 nn=14469
+  4!np=30714 qsp=4 rpq=5574 cbr=0 cng=528 gpc=3931 gps=639 nn=20042
+  5 np=28910 qsp=2 rpq=5246 cbr=0 cng=428 gpc=4105 gps=709 nn=18422
+  6!np=38648 qsp=5 rpq=7076 cbr=0 cng=840 gpc=4072 gps=961 nn=25699
+  7 np=37275 qsp=2 rpq=6873 cbr=0 cng=868 gpc=3416 gps=971 nn=25147
+
+The fields are as follows:
+
+o       The leading number is the CPU number, with "!" indicating
+        an offline CPU.
 
 o       "np" is the number of times that __rcu_pending() has been invoked
         for the corresponding flavor of RCU.
@@ -377,38 +432,23 @@ o	"gpc" is the number of times that an old grace period had
 o       "gps" is the number of times that a new grace period had started,
         but this CPU was not yet aware of it.
 
-o       "nn" is the number of times that this CPU needed nothing.  Alert
-        readers will note that the rcu "nn" number for a given CPU very
-        closely matches the rcu_bh "np" number for that same CPU.  This
-        is due to short-circuit evaluation in rcu_pending().
-
-
-The output of "cat rcu/rcutorture" looks as follows:
-
-rcutorture test sequence: 0 (test in progress)
-rcutorture update version number: 615
-
-The first line shows the number of rcutorture tests that have completed
-since boot.  If a test is currently running, the "(test in progress)"
-string will appear as shown above.  The second line shows the number of
-update cycles that the current test has started, or zero if there is
-no test in progress.
+o       "nn" is the number of times that this CPU needed nothing.
 
 
 The output of "cat rcu/rcuboost" looks as follows:
 
-0:5 tasks=.... kt=W ntb=0 neb=0 nnb=0 j=2f95 bt=300f
-     balk: nt=0 egt=989 bt=0 nb=0 ny=0 nos=16
-6:7 tasks=.... kt=W ntb=0 neb=0 nnb=0 j=2f95 bt=300f
-     balk: nt=0 egt=225 bt=0 nb=0 ny=0 nos=6
+0:3 tasks=.... kt=W ntb=0 neb=0 nnb=0 j=c864 bt=c894
+    balk: nt=0 egt=4695 bt=0 nb=0 ny=56 nos=0
+4:7 tasks=.... kt=W ntb=0 neb=0 nnb=0 j=c864 bt=c894
+    balk: nt=0 egt=6541 bt=0 nb=0 ny=126 nos=0
 
 This information is output only for rcu_preempt.  Each two-line entry
 corresponds to a leaf rcu_node strcuture.  The fields are as follows:
 
 o       "n:m" is the CPU-number range for the corresponding two-line
         entry.  In the sample output above, the first entry covers
-        CPUs zero through five and the second entry covers CPUs 6
-        and 7.
+        CPUs zero through three and the second entry covers CPUs four
+        through seven.
 
 o       "tasks=TNEB" gives the state of the various segments of the
         rnp->blocked_tasks list:
diff --git a/Documentation/RCU/whatisRCU.txt b/Documentation/RCU/whatisRCU.txt
index bf0f6de2aa00..0cc7820967f4 100644
--- a/Documentation/RCU/whatisRCU.txt
+++ b/Documentation/RCU/whatisRCU.txt
@@ -499,6 +499,8 @@ The foo_reclaim() function might appear as follows:
         {
                 struct foo *fp = container_of(rp, struct foo, rcu);
 
+                foo_cleanup(fp->a);
+
                 kfree(fp);
         }
 
@@ -521,6 +523,12 @@ o	Use call_rcu() -after- removing a data element from an
         read-side critical sections that might be referencing that
         data item.
 
+If the callback for call_rcu() is not doing anything more than calling
+kfree() on the structure, you can use kfree_rcu() instead of call_rcu()
+to avoid having to write your own callback:
+
+        kfree_rcu(old_fp, rcu);
+
 Again, see checklist.txt for additional rules governing the use of RCU.
 
 
@@ -773,8 +781,8 @@ a single atomic update, converting to RCU will require special care.
 
 Also, the presence of synchronize_rcu() means that the RCU version of
 delete() can now block.  If this is a problem, there is a callback-based
-mechanism that never blocks, namely call_rcu(), that can be used in
-place of synchronize_rcu().
+mechanism that never blocks, namely call_rcu() or kfree_rcu(), that can
+be used in place of synchronize_rcu().
 
 
 7.  FULL LIST OF RCU APIs
@@ -789,9 +797,7 @@ RCU list traversal:
         list_for_each_entry_rcu
         hlist_for_each_entry_rcu
         hlist_nulls_for_each_entry_rcu
-
-        list_for_each_continue_rcu      (to be deprecated in favor of new
-                                         list_for_each_entry_continue_rcu)
+        list_for_each_entry_continue_rcu
 
 RCU pointer/list update:
 
@@ -813,6 +819,7 @@ RCU:	Critical sections	Grace period		Barrier
         rcu_read_unlock         synchronize_rcu
         rcu_dereference         synchronize_rcu_expedited
                                 call_rcu
+                                kfree_rcu
 
 
 bh:     Critical sections       Grace period            Barrier
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index 2759f7c188f0..3c4e1b3b80a1 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -251,12 +251,13 @@ And there are a number of things that _must_ or _must_not_ be assumed:
 
      And for:
 
-        *A = X; Y = *A;
+        *A = X; *(A + 4) = Y;
 
-     we may get either of:
+     we may get any of:
 
-        STORE *A = X; Y = LOAD *A;
-        STORE *A = Y = X;
+        STORE *A = X; STORE *(A + 4) = Y;
+        STORE *(A + 4) = Y; STORE *A = X;
+        STORE {*A, *(A + 4) } = {X, Y};
 
 
 =========================