Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

Pull Ceph updates from Sage Weil:
 "We have a pile of bug fixes from Ilya, including a few patches that
  sync up the CRUSH code with the latest from userspace.

  There is also a long series from Zheng that fixes various issues with
  snapshots, inline data, and directory fsync, some simplification and
  improvement in the cap release code, and a rework of the caching of
  directory contents.

  To top it off there are a few small fixes and cleanups from Benoit and
  Hong"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (40 commits)
  rbd: use GFP_NOIO in rbd_obj_request_create()
  crush: fix a bug in tree bucket decode
  libceph: Fix ceph_tcp_sendpage()'s more boolean usage
  libceph: Remove spurious kunmap() of the zero page
  rbd: queue_depth map option
  rbd: store rbd_options in rbd_device
  rbd: terminate rbd_opts_tokens with Opt_err
  ceph: fix ceph_writepages_start()
  rbd: bump queue_max_segments
  ceph: rework dcache readdir
  crush: sync up with userspace
  crush: fix crash from invalid 'take' argument
  ceph: switch some GFP_NOFS memory allocation to GFP_KERNEL
  ceph: pre-allocate data structure that tracks caps flushing
  ceph: re-send flushing caps (which are revoked) in reconnect stage
  ceph: send TID of the oldest pending caps flush to MDS
  ceph: track pending caps flushing globally
  ceph: track pending caps flushing accurately
  libceph: fix wrong name "Ceph filesystem for Linux"
  ceph: fix directory fsync
  ...

10 files changed, 197 insertions, 119 deletions

diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 79e8f71aef5b..cb7db320dd27 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -352,8 +352,8 @@ ceph_parse_options(char *options, const char *dev_name,
         /* start with defaults */
         opt->flags = CEPH_OPT_DEFAULT;
         opt->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
-        opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT; /* seconds */
-        opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;   /* seconds */
+        opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT;
+        opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;
 
         /* get mon ip(s) */
         /* ip1[:port1][,ip2[:port2]...] */
@@ -439,13 +439,32 @@ ceph_parse_options(char *options, const char *dev_name,
                         pr_warn("ignoring deprecated osdtimeout option\n");
                         break;
                 case Opt_osdkeepalivetimeout:
-                        opt->osd_keepalive_timeout = intval;
+                        /* 0 isn't well defined right now, reject it */
+                        if (intval < 1 || intval > INT_MAX / 1000) {
+                                pr_err("osdkeepalive out of range\n");
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        opt->osd_keepalive_timeout =
+                                        msecs_to_jiffies(intval * 1000);
                         break;
                 case Opt_osd_idle_ttl:
-                        opt->osd_idle_ttl = intval;
+                        /* 0 isn't well defined right now, reject it */
+                        if (intval < 1 || intval > INT_MAX / 1000) {
+                                pr_err("osd_idle_ttl out of range\n");
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        opt->osd_idle_ttl = msecs_to_jiffies(intval * 1000);
                         break;
                 case Opt_mount_timeout:
-                        opt->mount_timeout = intval;
+                        /* 0 is "wait forever" (i.e. infinite timeout) */
+                        if (intval < 0 || intval > INT_MAX / 1000) {
+                                pr_err("mount_timeout out of range\n");
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        opt->mount_timeout = msecs_to_jiffies(intval * 1000);
                         break;
 
                 case Opt_share:
@@ -512,12 +531,14 @@ int ceph_print_client_options(struct seq_file *m, struct ceph_client *client)
                 seq_puts(m, "notcp_nodelay,");
 
         if (opt->mount_timeout != CEPH_MOUNT_TIMEOUT_DEFAULT)
-                seq_printf(m, "mount_timeout=%d,", opt->mount_timeout);
+                seq_printf(m, "mount_timeout=%d,",
+                           jiffies_to_msecs(opt->mount_timeout) / 1000);
         if (opt->osd_idle_ttl != CEPH_OSD_IDLE_TTL_DEFAULT)
-                seq_printf(m, "osd_idle_ttl=%d,", opt->osd_idle_ttl);
+                seq_printf(m, "osd_idle_ttl=%d,",
+                           jiffies_to_msecs(opt->osd_idle_ttl) / 1000);
         if (opt->osd_keepalive_timeout != CEPH_OSD_KEEPALIVE_DEFAULT)
                 seq_printf(m, "osdkeepalivetimeout=%d,",
-                           opt->osd_keepalive_timeout);
+                    jiffies_to_msecs(opt->osd_keepalive_timeout) / 1000);
 
         /* drop redundant comma */
         if (m->count != pos)
@@ -626,8 +647,8 @@ static int have_mon_and_osd_map(struct ceph_client *client)
  */
 int __ceph_open_session(struct ceph_client *client, unsigned long started)
 {
-        int err;
-        unsigned long timeout = client->options->mount_timeout * HZ;
+        unsigned long timeout = client->options->mount_timeout;
+        long err;
 
         /* open session, and wait for mon and osd maps */
         err = ceph_monc_open_session(&client->monc);
@@ -635,16 +656,15 @@ int __ceph_open_session(struct ceph_client *client, unsigned long started)
                 return err;
 
         while (!have_mon_and_osd_map(client)) {
-                err = -EIO;
                 if (timeout && time_after_eq(jiffies, started + timeout))
-                        return err;
+                        return -ETIMEDOUT;
 
                 /* wait */
                 dout("mount waiting for mon_map\n");
                 err = wait_event_interruptible_timeout(client->auth_wq,
                         have_mon_and_osd_map(client) || (client->auth_err < 0),
-                        timeout);
-                if (err == -EINTR || err == -ERESTARTSYS)
+                        ceph_timeout_jiffies(timeout));
+                if (err < 0)
                         return err;
                 if (client->auth_err < 0)
                         return client->auth_err;
@@ -721,5 +741,5 @@ module_exit(exit_ceph_lib);
 MODULE_AUTHOR("Sage Weil <sage@newdream.net>");
 MODULE_AUTHOR("Yehuda Sadeh <yehuda@hq.newdream.net>");
 MODULE_AUTHOR("Patience Warnick <patience@newdream.net>");
-MODULE_DESCRIPTION("Ceph filesystem for Linux");
+MODULE_DESCRIPTION("Ceph core library");
 MODULE_LICENSE("GPL");
diff --git a/net/ceph/crush/crush.c b/net/ceph/crush/crush.c
index 9d84ce4ea0df..80d7c3a97cb8 100644
--- a/net/ceph/crush/crush.c
+++ b/net/ceph/crush/crush.c
@@ -1,15 +1,11 @@
-
 #ifdef __KERNEL__
 # include <linux/slab.h>
+# include <linux/crush/crush.h>
 #else
-# include <stdlib.h>
-# include <assert.h>
-# define kfree(x) do { if (x) free(x); } while (0)
-# define BUG_ON(x) assert(!(x))
+# include "crush_compat.h"
+# include "crush.h"
 #endif
 
-#include <linux/crush/crush.h>
-
 const char *crush_bucket_alg_name(int alg)
 {
         switch (alg) {
@@ -134,6 +130,9 @@ void crush_destroy(struct crush_map *map)
                 kfree(map->rules);
         }
 
+#ifndef __KERNEL__
+        kfree(map->choose_tries);
+#endif
         kfree(map);
 }
 
diff --git a/net/ceph/crush/crush_ln_table.h b/net/ceph/crush/crush_ln_table.h
index 6192c7fc958c..aae534c901a4 100644
--- a/net/ceph/crush/crush_ln_table.h
+++ b/net/ceph/crush/crush_ln_table.h
@@ -10,20 +10,20 @@
  *
  */
 
-#if defined(__linux__)
-#include <linux/types.h>
-#elif defined(__FreeBSD__)
-#include <sys/types.h>
-#endif
-
 #ifndef CEPH_CRUSH_LN_H
 #define CEPH_CRUSH_LN_H
 
+#ifdef __KERNEL__
+# include <linux/types.h>
+#else
+# include "crush_compat.h"
+#endif
 
-// RH_LH_tbl[2*k] = 2^48/(1.0+k/128.0)
-// RH_LH_tbl[2*k+1] = 2^48*log2(1.0+k/128.0)
-
-static int64_t __RH_LH_tbl[128*2+2] = {
+/*
+ * RH_LH_tbl[2*k] = 2^48/(1.0+k/128.0)
+ * RH_LH_tbl[2*k+1] = 2^48*log2(1.0+k/128.0)
+ */
+static __s64 __RH_LH_tbl[128*2+2] = {
   0x0001000000000000ll, 0x0000000000000000ll, 0x0000fe03f80fe040ll, 0x000002dfca16dde1ll,
   0x0000fc0fc0fc0fc1ll, 0x000005b9e5a170b4ll, 0x0000fa232cf25214ll, 0x0000088e68ea899all,
   0x0000f83e0f83e0f9ll, 0x00000b5d69bac77ell, 0x0000f6603d980f67ll, 0x00000e26fd5c8555ll,
@@ -89,11 +89,12 @@ static int64_t __RH_LH_tbl[128*2+2] = {
   0x0000820820820821ll, 0x0000fa2f045e7832ll, 0x000081848da8faf1ll, 0x0000fba577877d7dll,
   0x0000810204081021ll, 0x0000fd1a708bbe11ll, 0x0000808080808081ll, 0x0000fe8df263f957ll,
   0x0000800000000000ll, 0x0000ffff00000000ll,
-  };
-
+};
 
-    // LL_tbl[k] = 2^48*log2(1.0+k/2^15);
-static int64_t __LL_tbl[256] = {
+/*
+ * LL_tbl[k] = 2^48*log2(1.0+k/2^15)
+ */
+static __s64 __LL_tbl[256] = {
   0x0000000000000000ull, 0x00000002e2a60a00ull, 0x000000070cb64ec5ull, 0x00000009ef50ce67ull,
   0x0000000cd1e588fdull, 0x0000000fb4747e9cull, 0x0000001296fdaf5eull, 0x0000001579811b58ull,
   0x000000185bfec2a1ull, 0x0000001b3e76a552ull, 0x0000001e20e8c380ull, 0x0000002103551d43ull,
@@ -160,7 +161,4 @@ static int64_t __LL_tbl[256] = {
   0x000002d4562d2ec6ull, 0x000002d73330209dull, 0x000002da102d63b0ull, 0x000002dced24f814ull,
 };
 
-
-
-
 #endif
diff --git a/net/ceph/crush/hash.c b/net/ceph/crush/hash.c
index 5bb63e37a8a1..ed123af49eba 100644
--- a/net/ceph/crush/hash.c
+++ b/net/ceph/crush/hash.c
@@ -1,6 +1,8 @@
-
-#include <linux/types.h>
-#include <linux/crush/hash.h>
+#ifdef __KERNEL__
+# include <linux/crush/hash.h>
+#else
+# include "hash.h"
+#endif
 
 /*
  * Robert Jenkins' function for mixing 32-bit values
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
index 5b47736d27d9..393bfb22d5bb 100644
--- a/net/ceph/crush/mapper.c
+++ b/net/ceph/crush/mapper.c
@@ -1,27 +1,31 @@
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2015 Intel Corporation All Rights Reserved
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+ */
 
 #ifdef __KERNEL__
 # include <linux/string.h>
 # include <linux/slab.h>
 # include <linux/bug.h>
 # include <linux/kernel.h>
-# ifndef dprintk
-#  define dprintk(args...)
-# endif
+# include <linux/crush/crush.h>
+# include <linux/crush/hash.h>
 #else
-# include <string.h>
-# include <stdio.h>
-# include <stdlib.h>
-# include <assert.h>
-# define BUG_ON(x) assert(!(x))
-# define dprintk(args...) /* printf(args) */
-# define kmalloc(x, f) malloc(x)
-# define kfree(x) free(x)
+# include "crush_compat.h"
+# include "crush.h"
+# include "hash.h"
 #endif
-
-#include <linux/crush/crush.h>
-#include <linux/crush/hash.h>
 #include "crush_ln_table.h"
 
+#define dprintk(args...) /* printf(args) */
+
 /*
  * Implement the core CRUSH mapping algorithm.
  */
@@ -139,7 +143,7 @@ static int bucket_list_choose(struct crush_bucket_list *bucket,
         int i;
 
         for (i = bucket->h.size-1; i >= 0; i--) {
-                __u64 w = crush_hash32_4(bucket->h.hash,x, bucket->h.items[i],
+                __u64 w = crush_hash32_4(bucket->h.hash, x, bucket->h.items[i],
                                          r, bucket->h.id);
                 w &= 0xffff;
                 dprintk("list_choose i=%d x=%d r=%d item %d weight %x "
@@ -238,43 +242,46 @@ static int bucket_straw_choose(struct crush_bucket_straw *bucket,
         return bucket->h.items[high];
 }
 
-// compute 2^44*log2(input+1)
-uint64_t crush_ln(unsigned xin)
+/* compute 2^44*log2(input+1) */
+static __u64 crush_ln(unsigned int xin)
 {
-    unsigned x=xin, x1;
-    int iexpon, index1, index2;
-    uint64_t RH, LH, LL, xl64, result;
+        unsigned int x = xin, x1;
+        int iexpon, index1, index2;
+        __u64 RH, LH, LL, xl64, result;
 
-    x++;
+        x++;
 
-    // normalize input
-    iexpon = 15;
-    while(!(x&0x18000)) { x<<=1; iexpon--; }
+        /* normalize input */
+        iexpon = 15;
+        while (!(x & 0x18000)) {
+                x <<= 1;
+                iexpon--;
+        }
 
-    index1 = (x>>8)<<1;
-    // RH ~ 2^56/index1
-    RH = __RH_LH_tbl[index1 - 256];
-    // LH ~ 2^48 * log2(index1/256)
-    LH = __RH_LH_tbl[index1 + 1 - 256];
+        index1 = (x >> 8) << 1;
+        /* RH ~ 2^56/index1 */
+        RH = __RH_LH_tbl[index1 - 256];
+        /* LH ~ 2^48 * log2(index1/256) */
+        LH = __RH_LH_tbl[index1 + 1 - 256];
 
-    // RH*x ~ 2^48 * (2^15 + xf), xf<2^8
-    xl64 = (int64_t)x * RH;
-    xl64 >>= 48;
-    x1 = xl64;
+        /* RH*x ~ 2^48 * (2^15 + xf), xf<2^8 */
+        xl64 = (__s64)x * RH;
+        xl64 >>= 48;
+        x1 = xl64;
 
-    result = iexpon;
-    result <<= (12 + 32);
+        result = iexpon;
+        result <<= (12 + 32);
 
-    index2 = x1 & 0xff;
-    // LL ~ 2^48*log2(1.0+index2/2^15)
-    LL = __LL_tbl[index2];
+        index2 = x1 & 0xff;
+        /* LL ~ 2^48*log2(1.0+index2/2^15) */
+        LL = __LL_tbl[index2];
 
-    LH = LH + LL;
+        LH = LH + LL;
 
-    LH >>= (48-12 - 32);
-    result += LH;
+        LH >>= (48 - 12 - 32);
+        result += LH;
 
-    return result;
+        return result;
 }
 
 
@@ -290,9 +297,9 @@ uint64_t crush_ln(unsigned xin)
 static int bucket_straw2_choose(struct crush_bucket_straw2 *bucket,
                                 int x, int r)
 {
-        unsigned i, high = 0;
-        unsigned u;
-        unsigned w;
+        unsigned int i, high = 0;
+        unsigned int u;
+        unsigned int w;
         __s64 ln, draw, high_draw = 0;
 
         for (i = 0; i < bucket->h.size; i++) {
@@ -567,6 +574,10 @@ reject:
                 out[outpos] = item;
                 outpos++;
                 count--;
+#ifndef __KERNEL__
+                if (map->choose_tries && ftotal <= map->choose_total_tries)
+                        map->choose_tries[ftotal]++;
+#endif
         }
 
         dprintk("CHOOSE returns %d\n", outpos);
@@ -610,6 +621,20 @@ static void crush_choose_indep(const struct crush_map *map,
         }
 
         for (ftotal = 0; left > 0 && ftotal < tries; ftotal++) {
+#ifdef DEBUG_INDEP
+                if (out2 && ftotal) {
+                        dprintk("%u %d a: ", ftotal, left);
+                        for (rep = outpos; rep < endpos; rep++) {
+                                dprintk(" %d", out[rep]);
+                        }
+                        dprintk("\n");
+                        dprintk("%u %d b: ", ftotal, left);
+                        for (rep = outpos; rep < endpos; rep++) {
+                                dprintk(" %d", out2[rep]);
+                        }
+                        dprintk("\n");
+                }
+#endif
                 for (rep = outpos; rep < endpos; rep++) {
                         if (out[rep] != CRUSH_ITEM_UNDEF)
                                 continue;
@@ -726,6 +751,24 @@ static void crush_choose_indep(const struct crush_map *map,
                         out2[rep] = CRUSH_ITEM_NONE;
                 }
         }
+#ifndef __KERNEL__
+        if (map->choose_tries && ftotal <= map->choose_total_tries)
+                map->choose_tries[ftotal]++;
+#endif
+#ifdef DEBUG_INDEP
+        if (out2) {
+                dprintk("%u %d a: ", ftotal, left);
+                for (rep = outpos; rep < endpos; rep++) {
+                        dprintk(" %d", out[rep]);
+                }
+                dprintk("\n");
+                dprintk("%u %d b: ", ftotal, left);
+                for (rep = outpos; rep < endpos; rep++) {
+                        dprintk(" %d", out2[rep]);
+                }
+                dprintk("\n");
+        }
+#endif
 }
 
 /**
@@ -790,8 +833,15 @@ int crush_do_rule(const struct crush_map *map,
 
                 switch (curstep->op) {
                 case CRUSH_RULE_TAKE:
-                        w[0] = curstep->arg1;
-                        wsize = 1;
+                        if ((curstep->arg1 >= 0 &&
+                             curstep->arg1 < map->max_devices) ||
+                            (-1-curstep->arg1 < map->max_buckets &&
+                             map->buckets[-1-curstep->arg1])) {
+                                w[0] = curstep->arg1;
+                                wsize = 1;
+                        } else {
+                                dprintk(" bad take value %d\n", curstep->arg1);
+                        }
                         break;
 
                 case CRUSH_RULE_SET_CHOOSE_TRIES:
@@ -877,7 +927,7 @@ int crush_do_rule(const struct crush_map *map,
                                                 0);
                                 } else {
                                         out_size = ((numrep < (result_max-osize)) ?
-                                                    numrep : (result_max-osize));
+                                                    numrep : (result_max-osize));
                                         crush_choose_indep(
                                                 map,
                                                 map->buckets[-1-w[i]],
@@ -923,5 +973,3 @@ int crush_do_rule(const struct crush_map *map,
         }
         return result_len;
 }
-
-
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 073262fea6dd..1679f47280e2 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -278,7 +278,6 @@ static void _ceph_msgr_exit(void)
         ceph_msgr_slab_exit();
 
         BUG_ON(zero_page == NULL);
-        kunmap(zero_page);
         page_cache_release(zero_page);
         zero_page = NULL;
 }
@@ -1545,7 +1544,7 @@ static int write_partial_message_data(struct ceph_connection *con)
                 page = ceph_msg_data_next(&msg->cursor, &page_offset, &length,
                                                         &last_piece);
                 ret = ceph_tcp_sendpage(con->sock, page, page_offset,
-                                      length, last_piece);
+                                        length, !last_piece);
                 if (ret <= 0) {
                         if (do_datacrc)
                                 msg->footer.data_crc = cpu_to_le32(crc);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 2b3cf05e87b0..9d6ff1215928 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -298,21 +298,28 @@ void ceph_monc_request_next_osdmap(struct ceph_mon_client *monc)
 }
 EXPORT_SYMBOL(ceph_monc_request_next_osdmap);
 
+/*
+ * Wait for an osdmap with a given epoch.
+ *
+ * @epoch: epoch to wait for
+ * @timeout: in jiffies, 0 means "wait forever"
+ */
 int ceph_monc_wait_osdmap(struct ceph_mon_client *monc, u32 epoch,
                           unsigned long timeout)
 {
         unsigned long started = jiffies;
-        int ret;
+        long ret;
 
         mutex_lock(&monc->mutex);
         while (monc->have_osdmap < epoch) {
                 mutex_unlock(&monc->mutex);
 
-                if (timeout != 0 && time_after_eq(jiffies, started + timeout))
+                if (timeout && time_after_eq(jiffies, started + timeout))
                         return -ETIMEDOUT;
 
                 ret = wait_event_interruptible_timeout(monc->client->auth_wq,
-                                         monc->have_osdmap >= epoch, timeout);
+                                                monc->have_osdmap >= epoch,
+                                                ceph_timeout_jiffies(timeout));
                 if (ret < 0)
                         return ret;
 
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index c4ec9239249a..50033677c0fa 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -296,6 +296,9 @@ static void osd_req_op_data_release(struct ceph_osd_request *osd_req,
         case CEPH_OSD_OP_CMPXATTR:
                 ceph_osd_data_release(&op->xattr.osd_data);
                 break;
+        case CEPH_OSD_OP_STAT:
+                ceph_osd_data_release(&op->raw_data_in);
+                break;
         default:
                 break;
         }
@@ -450,7 +453,7 @@ __CEPH_FORALL_OSD_OPS(GENERATE_CASE)
  */
 static struct ceph_osd_req_op *
 _osd_req_op_init(struct ceph_osd_request *osd_req, unsigned int which,
-                                u16 opcode)
+                 u16 opcode, u32 flags)
 {
         struct ceph_osd_req_op *op;
 
@@ -460,14 +463,15 @@ _osd_req_op_init(struct ceph_osd_request *osd_req, unsigned int which,
         op = &osd_req->r_ops[which];
         memset(op, 0, sizeof (*op));
         op->op = opcode;
+        op->flags = flags;
 
         return op;
 }
 
 void osd_req_op_init(struct ceph_osd_request *osd_req,
-                                unsigned int which, u16 opcode)
+                     unsigned int which, u16 opcode, u32 flags)
 {
-        (void)_osd_req_op_init(osd_req, which, opcode);
+        (void)_osd_req_op_init(osd_req, which, opcode, flags);
 }
 EXPORT_SYMBOL(osd_req_op_init);
 
@@ -476,7 +480,8 @@ void osd_req_op_extent_init(struct ceph_osd_request *osd_req,
                                 u64 offset, u64 length,
                                 u64 truncate_size, u32 truncate_seq)
 {
-        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which, opcode);
+        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
+                                                      opcode, 0);
         size_t payload_len = 0;
 
         BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE &&
@@ -515,7 +520,8 @@ EXPORT_SYMBOL(osd_req_op_extent_update);
 void osd_req_op_cls_init(struct ceph_osd_request *osd_req, unsigned int which,
                         u16 opcode, const char *class, const char *method)
 {
-        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which, opcode);
+        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
+                                                      opcode, 0);
         struct ceph_pagelist *pagelist;
         size_t payload_len = 0;
         size_t size;
@@ -552,7 +558,8 @@ int osd_req_op_xattr_init(struct ceph_osd_request *osd_req, unsigned int which,
                           u16 opcode, const char *name, const void *value,
                           size_t size, u8 cmp_op, u8 cmp_mode)
 {
-        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which, opcode);
+        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
+                                                      opcode, 0);
         struct ceph_pagelist *pagelist;
         size_t payload_len;
 
@@ -585,7 +592,8 @@ void osd_req_op_watch_init(struct ceph_osd_request *osd_req,
                                 unsigned int which, u16 opcode,
                                 u64 cookie, u64 version, int flag)
 {
-        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which, opcode);
+        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
+                                                      opcode, 0);
 
         BUG_ON(opcode != CEPH_OSD_OP_NOTIFY_ACK && opcode != CEPH_OSD_OP_WATCH);
 
@@ -602,7 +610,8 @@ void osd_req_op_alloc_hint_init(struct ceph_osd_request *osd_req,
                                 u64 expected_write_size)
 {
         struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
-                                                      CEPH_OSD_OP_SETALLOCHINT);
+                                                      CEPH_OSD_OP_SETALLOCHINT,
+                                                      0);
 
         op->alloc_hint.expected_object_size = expected_object_size;
         op->alloc_hint.expected_write_size = expected_write_size;
@@ -786,7 +795,7 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
         }
 
         if (opcode == CEPH_OSD_OP_CREATE || opcode == CEPH_OSD_OP_DELETE) {
-                osd_req_op_init(req, which, opcode);
+                osd_req_op_init(req, which, opcode, 0);
         } else {
                 u32 object_size = le32_to_cpu(layout->fl_object_size);
                 u32 object_base = off - objoff;
@@ -1088,7 +1097,7 @@ static void __move_osd_to_lru(struct ceph_osd_client *osdc,
         BUG_ON(!list_empty(&osd->o_osd_lru));
 
         list_add_tail(&osd->o_osd_lru, &osdc->osd_lru);
-        osd->lru_ttl = jiffies + osdc->client->options->osd_idle_ttl * HZ;
+        osd->lru_ttl = jiffies + osdc->client->options->osd_idle_ttl;
 }
 
 static void maybe_move_osd_to_lru(struct ceph_osd_client *osdc,
@@ -1199,7 +1208,7 @@ static struct ceph_osd *__lookup_osd(struct ceph_osd_client *osdc, int o)
 static void __schedule_osd_timeout(struct ceph_osd_client *osdc)
 {
         schedule_delayed_work(&osdc->timeout_work,
-                        osdc->client->options->osd_keepalive_timeout * HZ);
+                              osdc->client->options->osd_keepalive_timeout);
 }
 
 static void __cancel_osd_timeout(struct ceph_osd_client *osdc)
@@ -1567,10 +1576,9 @@ static void handle_timeout(struct work_struct *work)
 {
         struct ceph_osd_client *osdc =
                 container_of(work, struct ceph_osd_client, timeout_work.work);
+        struct ceph_options *opts = osdc->client->options;
         struct ceph_osd_request *req;
         struct ceph_osd *osd;
-        unsigned long keepalive =
-                osdc->client->options->osd_keepalive_timeout * HZ;
         struct list_head slow_osds;
         dout("timeout\n");
         down_read(&osdc->map_sem);
@@ -1586,7 +1594,8 @@ static void handle_timeout(struct work_struct *work)
          */
         INIT_LIST_HEAD(&slow_osds);
         list_for_each_entry(req, &osdc->req_lru, r_req_lru_item) {
-                if (time_before(jiffies, req->r_stamp + keepalive))
+                if (time_before(jiffies,
+                                req->r_stamp + opts->osd_keepalive_timeout))
                         break;
 
                 osd = req->r_osd;
@@ -1613,8 +1622,7 @@ static void handle_osds_timeout(struct work_struct *work)
         struct ceph_osd_client *osdc =
                 container_of(work, struct ceph_osd_client,
                              osds_timeout_work.work);
-        unsigned long delay =
-                osdc->client->options->osd_idle_ttl * HZ >> 2;
+        unsigned long delay = osdc->client->options->osd_idle_ttl / 4;
 
         dout("osds timeout\n");
         down_read(&osdc->map_sem);
@@ -2619,7 +2627,7 @@ int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
         osdc->event_count = 0;
 
         schedule_delayed_work(&osdc->osds_timeout_work,
-           round_jiffies_relative(osdc->client->options->osd_idle_ttl * HZ));
+            round_jiffies_relative(osdc->client->options->osd_idle_ttl));
 
         err = -ENOMEM;
         osdc->req_mempool = mempool_create_kmalloc_pool(10,
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 15796696d64e..4a3125836b64 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
 {
         int j;
         dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-        ceph_decode_32_safe(p, end, b->num_nodes, bad);
+        ceph_decode_8_safe(p, end, b->num_nodes, bad);
         b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
         if (b->node_weights == NULL)
                 return -ENOMEM;
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index 096d91447e06..d4f5f220a8e5 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -51,10 +51,7 @@ void ceph_put_page_vector(struct page **pages, int num_pages, bool dirty)
                         set_page_dirty_lock(pages[i]);
                 put_page(pages[i]);
         }
-        if (is_vmalloc_addr(pages))
-                vfree(pages);
-        else
-                kfree(pages);
+        kvfree(pages);
 }
 EXPORT_SYMBOL(ceph_put_page_vector);