sys-cluster/ceph: Revision bump to 10.2.9, pull in fixes from upstream

Also update openrc dependency to make sure we are using a version that
supports the supervisor stuff properly.

Package-Manager: Portage-2.3.6, Repoman-2.3.3

7 files changed, 589 insertions, 0 deletions

diff --git a/sys-cluster/ceph/ceph-10.2.9-r3.ebuild b/sys-cluster/ceph/ceph-10.2.9-r3.ebuild
new file mode 100644
index 000000000000..d74301f3760b
--- /dev/null
+++ b/sys-cluster/ceph/ceph-10.2.9-r3.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+PYTHON_COMPAT=( python{2_7,3_{4,5,6}} )
+
+inherit check-reqs autotools eutils python-r1 udev user \
+	readme.gentoo-r1 systemd versionator flag-o-matic
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/ceph/ceph.git"
+	SRC_URI=""
+else
+	SRC_URI="https://download.ceph.com/tarballs/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~x86"
+fi
+
+DESCRIPTION="Ceph distributed filesystem"
+HOMEPAGE="https://ceph.com/"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+
+IUSE="babeltrace cephfs cryptopp debug fuse gtk jemalloc ldap +libaio"
+IUSE+=" libatomic lttng +nss +radosgw static-libs +tcmalloc test xfs zfs"
+
+# unbundling code commented out pending bugs 584056 and 584058
+#>=dev-libs/jerasure-2.0.0-r1
+#>=dev-libs/gf-complete-2.0.0
+COMMON_DEPEND="
+	app-arch/snappy:=
+	sys-libs/zlib:=
+	app-arch/lz4:=
+	app-arch/bzip2:=
+	app-arch/zstd:=
+	dev-libs/boost:=[threads]
+	dev-libs/libaio:=
+	dev-libs/leveldb:=[snappy]
+	nss? ( dev-libs/nss:= )
+	libatomic? ( dev-libs/libatomic_ops:= )
+	cryptopp? ( dev-libs/crypto++:= )
+	sys-apps/keyutils
+	sys-apps/util-linux
+	dev-libs/libxml2:=
+	radosgw? ( dev-libs/fcgi:= )
+	ldap? ( net-nds/openldap:= )
+	babeltrace? ( dev-util/babeltrace )
+	fuse? ( sys-fs/fuse:0= )
+	xfs? ( sys-fs/xfsprogs:= )
+	zfs? ( sys-fs/zfs:= )
+	gtk? (
+		x11-libs/gtk+:2=
+		dev-cpp/gtkmm:2.4
+		gnome-base/librsvg:=
+	)
+	radosgw? (
+		dev-libs/fcgi:=
+		dev-libs/expat:=
+		net-misc/curl:=
+	)
+	jemalloc? ( dev-libs/jemalloc:= )
+	!jemalloc? ( =dev-util/google-perftools-2.4*:= )
+	lttng? ( dev-util/lttng-ust:= )
+	${PYTHON_DEPS}
+	"
+DEPEND="${COMMON_DEPEND}
+	dev-python/cython[${PYTHON_USEDEP}]
+	app-arch/cpio
+	virtual/pkgconfig
+	dev-python/sphinx
+	test? (
+		sys-fs/btrfs-progs
+		sys-apps/grep[pcre]
+		dev-python/tox[${PYTHON_USEDEP}]
+		dev-python/virtualenv[${PYTHON_USEDEP}]
+	)"
+RDEPEND="${COMMON_DEPEND}
+	sys-apps/hdparm
+	sys-block/parted
+	sys-fs/cryptsetup
+	sys-apps/gptfdisk
+	!<sys-apps/openrc-0.26.3
+	dev-python/flask[${PYTHON_USEDEP}]
+	dev-python/requests[${PYTHON_USEDEP}]
+	"
+REQUIRED_USE="
+	$(python_gen_useflags 'python2*')
+	${PYTHON_REQUIRED_USE}
+	^^ ( nss cryptopp )
+	?? ( jemalloc tcmalloc )
+	"
+
+# work around bug in ceph compilation (rgw/ceph_dencoder-rgw_dencoder.o... undefined reference to `vtable for RGWZoneGroup')
+REQUIRED_USE+=" radosgw"
+
+#RESTRICT="test? ( userpriv )"
+
+# distribution tarball does not include everything needed for tests
+RESTRICT+=" test"
+
+STRIP_MASK="/usr/lib*/rados-classes/*"
+
+UNBUNDLE_LIBS=(
+	src/erasure-code/jerasure/jerasure
+	src/erasure-code/jerasure/gf-complete
+)
+
+PATCHES=(
+	"${FILESDIR}/ceph-10.2.0-dont-use-virtualenvs.patch"
+	#"${FILESDIR}/ceph-10.2.1-unbundle-jerasure.patch"
+	"${FILESDIR}/${PN}-10.2.1-libzfs.patch"
+	"${FILESDIR}/${PN}-10.2.3-build-without-openldap.patch"
+	"${FILESDIR}/${PN}-10.2.5-Make-RBD-Python-bindings-compatible-with-Python-3.patch"
+	"${FILESDIR}/${PN}-10.2.5-Make-CephFS-bindings-and-tests-compatible-with-Python-3.patch"
+	"${FILESDIR}/${PN}-10.2.7-fix-compilation-with-zstd.patch"
+	# pull in some bugfixes from upstream
+	"${FILESDIR}/${PN}-10.2.9-libradosstriper_fix_format_injection_vulnerability.patch"
+	"${FILESDIR}/${PN}-10.2.9-rbd-nbd_relax_size_check_for_newer_kernel_versions.patch"
+	"${FILESDIR}/${PN}-10.2.9-filestore_fix_infinit_loops_in_fiemap.patch"
+	"${FILESDIR}/${PN}-10.2.9-librados_Fix_deadlock_in_watch_flush.patch"
+	"${FILESDIR}/${PN}-10.2.9-librbd_filter_expected_error_codes_from_is_exclusive_lock_owner.patch"
+	"${FILESDIR}/${PN}-10.2.9-osd-scrub_to_specifies_clone_ver_but_transaction_include.patch"
+	"${FILESDIR}/${PN}-10.2.9-rbd-do_not_attempt_to_load_key_if_auth_is_disabled.patch"
+	"${FILESDIR}/${PN}-10.2.9-unlock_sdata_op_ordering_lock_with_sdata_lock.patch"
+
+)
+
+check-reqs_export_vars() {
+	if use debug; then
+		CHECKREQS_DISK_BUILD="23G"
+		CHECKREQS_DISK_USR="7G"
+	elif use amd64; then
+		CHECKREQS_DISK_BUILD="12G"
+		CHECKREQS_DISK_USR="450M"
+	else
+		CHECKREQS_DISK_BUILD="1400M"
+		CHECKREQS_DISK_USR="450M"
+	fi
+
+	export CHECKREQS_DISK_BUILD CHECKREQS_DISK_USR
+}
+
+user_setup() {
+	enewgroup ceph ${CEPH_GID}
+	enewuser ceph "${CEPH_UID:--1}" -1 /var/lib/ceph ceph
+}
+
+emake_python_bindings() {
+	local action="${1}" params binding module
+	shift
+	params=("${@}")
+
+	__emake_python_bindings_do_impl() {
+		ceph_run_econf "${EPYTHON}"
+		emake "${params[@]}" PYTHON="${EPYTHON}" "${binding}-pybind-${action}"
+
+		# these don't work and aren't needed on python3
+		if [[ ${EBUILD_PHASE} == install ]]; then
+			for module in "${S}"/src/pybind/*.py; do
+				module_basename="$(basename "${module}")"
+				if [[ ${module_basename} == ceph_volume_client.py ]] && ! use cephfs; then
+					continue
+				elif [[ ! -e "${ED}/$(python_get_sitedir)/${module_basename}" ]]; then
+					python_domodule ${module}
+				fi
+			done
+		fi
+	}
+
+	pushd "${S}/src"
+	for binding in rados rbd $(use cephfs && echo cephfs); do
+		python_foreach_impl __emake_python_bindings_do_impl
+	done
+	popd
+
+	unset __emake_python_bindings_do_impl
+}
+
+pkg_pretend() {
+	check-reqs_export_vars
+	check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	python_setup
+	check-reqs_export_vars
+	check-reqs_pkg_setup
+	user_setup
+}
+
+src_prepare() {
+	default
+
+	# remove tests that need root access
+	rm src/test/cli/ceph-authtool/cap*.t
+
+	#rm -rf "${UNBUNDLE_LIBS[@]}"
+
+	append-flags -fPIC
+	eautoreconf
+}
+
+src_configure() {
+	ECONFARGS=(
+		--without-hadoop
+		--includedir=/usr/include
+		$(use_with cephfs)
+		$(use_with debug)
+		$(use_with fuse)
+		$(use_with libaio)
+		$(use_with libatomic libatomic-ops)
+		$(use_with nss)
+		$(use_with cryptopp)
+		$(use_with radosgw)
+		$(use_with gtk gtk2)
+		$(use_enable static-libs static)
+		$(use_with jemalloc)
+		$(use_with xfs libxfs)
+		$(use_with zfs libzfs)
+		$(use_with lttng )
+		$(use_with babeltrace)
+		$(use_with ldap openldap)
+		$(use jemalloc || usex tcmalloc " --with-tcmalloc" " --with-tcmalloc-minimal")
+		--with-mon
+		--with-eventfd
+		--with-cython
+		--without-kinetic
+		--without-librocksdb
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+	)
+
+	# we can only use python2.7 for building at the moment
+	ceph_run_econf "python2*"
+}
+
+ceph_run_econf() {
+	[[ -z ${ECONFARGS} ]] && die "called ${FUNCNAME[0]} with ECONFARGS unset"
+	[[ -z ${1} ]] && die "called ${FUNCNAME[0]} without passing python implementation"
+
+	pushd "${S}" >/dev/null || die
+	#
+	# This generates a QA warning about running econf in src_compile
+	# and src_install. Unfortunately the only other way to do this would
+	# involve building all of for each python implementation times, which
+	# wastes a _lot_ of CPU time and disk space. This hack will no longer
+	# be needed with >=ceph-11.2.
+	#
+	python_setup "${1}"
+	econf "${ECONFARGS[@]}"
+
+	popd >/dev/null || die
+}
+
+src_compile() {
+	emake
+	emake_python_bindings all
+
+	use test && emake check-local
+}
+
+src_test() {
+	make check || die "make check failed"
+}
+
+src_install() {
+	default
+	emake_python_bindings install-exec "DESTDIR=\"${D}\""
+
+	prune_libtool_files --all
+
+	exeinto /usr/$(get_libdir)/ceph
+	newexe src/init-ceph ceph_init.sh
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}"/ceph.logrotate ${PN}
+
+	keepdir /var/lib/${PN}{,/tmp} /var/log/${PN}/stat
+
+	fowners -R ceph:ceph /var/lib/ceph /var/log/ceph
+
+	newinitd "${FILESDIR}/rbdmap.initd" rbdmap
+	newinitd "${FILESDIR}/${PN}.initd-r5" ${PN}
+	newconfd "${FILESDIR}/${PN}.confd-r3" ${PN}
+
+	insinto /etc/sysctl.d
+	newins "${FILESDIR}"/sysctld 90-${PN}.conf
+
+	use tcmalloc && newenvd "${FILESDIR}"/envd-tcmalloc 99${PN}-tcmalloc
+
+	systemd_install_serviced "${FILESDIR}/ceph-mds_at.service.conf" "ceph-mds@.service"
+	systemd_install_serviced "${FILESDIR}/ceph-osd_at.service.conf" "ceph-osd@.service"
+
+	udev_dorules udev/*.rules
+
+	readme.gentoo_create_doc
+
+	python_setup 'python2*'
+	python_fix_shebang "${ED}"/usr/{,s}bin/
+
+	# python_fix_shebang apparently is not idempotent
+	sed -i -r  's:(/usr/lib/python-exec/python[0-9]\.[0-9]/python)[0-9]\.[0-9]:\1:' \
+		"${ED}"/usr/{sbin/ceph-disk,bin/ceph-detect-init} || die "sed failed"
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-filestore_fix_infinit_loops_in_fiemap.patch b/sys-cluster/ceph/files/ceph-10.2.9-filestore_fix_infinit_loops_in_fiemap.patch
new file mode 100644
index 000000000000..e67113e51cc8
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-filestore_fix_infinit_loops_in_fiemap.patch
@@ -0,0 +1,82 @@
+From b52bfe6b443f0ff88c8614441752102058063699 Mon Sep 17 00:00:00 2001
+From: Ning Yao <yaoning@unitedstack.com>
+Date: Thu, 6 Apr 2017 11:12:04 +0000
+Subject: [PATCH] os/filestore: fix infinit loops in fiemap()
+
+since fiemap can get extents based on offset --> len
+but we should consider last extents is retrieved when len == 0
+even though it is not last fiemap extents
+
+Signed-off-by: Ning Yao <yaoning@unitedstack.com>
+(cherry picked from commit 36f6b668a8910d76847674086cbc86910c78faee)
+---
+ src/os/filestore/FileStore.cc      | 13 +++++--------
+ src/test/objectstore/store_test.cc | 21 +++++++++++++++++++++
+ 2 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/src/os/filestore/FileStore.cc b/src/os/filestore/FileStore.cc
+index c47b0d0d2eae..95f48cdf4960 100644
+--- a/src/os/filestore/FileStore.cc
++++ b/src/os/filestore/FileStore.cc
+@@ -3102,17 +3102,14 @@ int FileStore::_do_fiemap(int fd, uint64_t offset, size_t len,
+     i++;
+     last = extent++;
+   }
+-  const bool is_last = last->fe_flags & FIEMAP_EXTENT_LAST;
++  uint64_t xoffset = last->fe_logical + last->fe_length - offset;
++  offset = last->fe_logical + last->fe_length;
++  len -= xoffset;
++  const bool is_last = (last->fe_flags & FIEMAP_EXTENT_LAST) || (len == 0);
++  free(fiemap);
+   if (!is_last) {
+-    uint64_t xoffset = last->fe_logical + last->fe_length - offset;
+-    offset = last->fe_logical + last->fe_length;
+-    len -= xoffset;
+-    free(fiemap); /* fix clang warn: use-after-free */
+     goto more;
+   }
+-  else {
+-    free(fiemap);
+-  }
+ 
+   return r;
+ }
+diff --git a/src/test/objectstore/store_test.cc b/src/test/objectstore/store_test.cc
+index 5ab011ad17d8..4cada7e2e435 100644
+--- a/src/test/objectstore/store_test.cc
++++ b/src/test/objectstore/store_test.cc
+@@ -279,6 +279,7 @@ TEST_P(StoreTest, FiemapHoles) {
+     ASSERT_EQ(r, 0);
+   }
+   {
++    //fiemap test from 0 to SKIP_STEP * (MAX_EXTENTS - 1) + 3
+     bufferlist bl;
+     store->fiemap(cid, oid, 0, SKIP_STEP * (MAX_EXTENTS - 1) + 3, bl);
+     map<uint64_t,uint64_t> m, e;
+@@ -295,6 +296,26 @@ TEST_P(StoreTest, FiemapHoles) {
+     ASSERT_TRUE((m.size() == 1 &&
+ 		 m[0] > SKIP_STEP * (MAX_EXTENTS - 1)) ||
+ 		 (m.size() == MAX_EXTENTS && extents_exist));
++
++    // fiemap test from SKIP_STEP to SKIP_STEP * (MAX_EXTENTS - 2) + 3
++    // reset bufferlist and map
++    bl.clear();
++    m.clear();
++    e.clear();
++    store->fiemap(cid, oid, SKIP_STEP, SKIP_STEP * (MAX_EXTENTS - 2) + 3, bl);
++    p = bl.begin();
++    ::decode(m, p);
++    cout << " got " << m << std::endl;
++    ASSERT_TRUE(!m.empty());
++    ASSERT_GE(m[SKIP_STEP], 3u);
++    extents_exist = true;
++    if (m.size() == (MAX_EXTENTS - 2)) {
++      for (uint64_t i = 1; i < MAX_EXTENTS - 1; i++)
++	extents_exist = extents_exist && m.count(SKIP_STEP*i);
++    }
++    ASSERT_TRUE((m.size() == 1 &&
++		 m[SKIP_STEP] > SKIP_STEP * (MAX_EXTENTS - 2)) ||
++		 (m.size() == (MAX_EXTENTS - 1) && extents_exist));
+   }
+   {
+     ObjectStore::Transaction t;
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-librados_Fix_deadlock_in_watch_flush.patch b/sys-cluster/ceph/files/ceph-10.2.9-librados_Fix_deadlock_in_watch_flush.patch
new file mode 100644
index 000000000000..77ab14b4295d
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-librados_Fix_deadlock_in_watch_flush.patch
@@ -0,0 +1,61 @@
+From 2fb04c40804f646b4cdd3a55ec8a9e9df95b9360 Mon Sep 17 00:00:00 2001
+From: Xiaoxi Chen <xiaoxchen@ebay.com>
+Date: Sat, 10 Sep 2016 00:23:55 +0800
+Subject: [PATCH] Librados: Fix deadlock in watch_flush
+
+In previous code, in the watch_flush, it is waiting on conditon
+with holding the "lock". The condition will only be signal by
+finisher thread, but sadly, in some cases,when finisher queue
+is not empty, some context need to take the "lock", thus deadlock.
+
+To avoid concurrent call to shutdown cause race condition, add
+a shutdown_lock to ensure only one concurrent in shutdown function.
+
+Signed-off-by: Xiaoxi Chen <xiaoxchen@ebay.com>
+---
+ src/librados/RadosClient.cc | 4 ++++
+ src/librados/RadosClient.h  | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/src/librados/RadosClient.cc b/src/librados/RadosClient.cc
+index 8c5e8ed803fa..230e8b53ecd9 100644
+--- a/src/librados/RadosClient.cc
++++ b/src/librados/RadosClient.cc
+@@ -72,6 +72,7 @@ librados::RadosClient::RadosClient(CephContext *cct_)
+     instance_id(0),
+     objecter(NULL),
+     lock("librados::RadosClient::lock"),
++    shutdown_lock("librados::RadosClient::shutdown_lock"),
+     timer(cct, lock),
+     refcnt(1),
+     log_last_version(0), log_cb(NULL), log_cb_arg(NULL),
+@@ -324,6 +325,7 @@ int librados::RadosClient::connect()
+ 
+ void librados::RadosClient::shutdown()
+ {
++  Mutex::Locker l(shutdown_lock);
+   lock.Lock();
+   if (state == DISCONNECTED) {
+     lock.Unlock();
+@@ -338,7 +340,9 @@ void librados::RadosClient::shutdown()
+   if (state == CONNECTED) {
+     if (need_objecter) {
+       // make sure watch callbacks are flushed
++      lock.Unlock();
+       watch_flush();
++      lock.Lock();
+     }
+     finisher.wait_for_empty();
+     finisher.stop();
+diff --git a/src/librados/RadosClient.h b/src/librados/RadosClient.h
+index f495ba5966c2..a8ef2070ddcb 100644
+--- a/src/librados/RadosClient.h
++++ b/src/librados/RadosClient.h
+@@ -62,6 +62,7 @@ class librados::RadosClient : public Dispatcher
+   Objecter *objecter;
+ 
+   Mutex lock;
++  Mutex shutdown_lock;
+   Cond cond;
+   SafeTimer timer;
+   int refcnt;
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-librbd_filter_expected_error_codes_from_is_exclusive_lock_owner.patch b/sys-cluster/ceph/files/ceph-10.2.9-librbd_filter_expected_error_codes_from_is_exclusive_lock_owner.patch
new file mode 100644
index 000000000000..6800285318f0
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-librbd_filter_expected_error_codes_from_is_exclusive_lock_owner.patch
@@ -0,0 +1,28 @@
+From 787ba33e5dba285dff874955a8f0d7aabd3f87fe Mon Sep 17 00:00:00 2001
+From: Jason Dillaman <dillaman@redhat.com>
+Date: Mon, 5 Jun 2017 08:17:05 -0400
+Subject: [PATCH] librbd: filter expected error codes from
+ is_exclusive_lock_owner
+
+Fixes: http://tracker.ceph.com/issues/20182
+Signed-off-by: Jason Dillaman <dillaman@redhat.com>
+(cherry picked from commit d4daaf54e6bc42cd4fb2111ea20b2042941b0c31)
+---
+ src/librbd/internal.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/librbd/internal.cc b/src/librbd/internal.cc
+index 9fecb1e1688f..6021be078090 100644
+--- a/src/librbd/internal.cc
++++ b/src/librbd/internal.cc
+@@ -2110,7 +2110,9 @@ int mirror_image_disable_internal(ImageCtx *ictx, bool force,
+     // might have been blacklisted by peer -- ensure we still own
+     // the lock by pinging the OSD
+     int r = ictx->exclusive_lock->assert_header_locked();
+-    if (r < 0) {
++    if (r == -EBUSY || r == -ENOENT) {
++      return 0;
++    } else if (r < 0) {
+       return r;
+     }
+ 
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-osd-scrub_to_specifies_clone_ver_but_transaction_include.patch b/sys-cluster/ceph/files/ceph-10.2.9-osd-scrub_to_specifies_clone_ver_but_transaction_include.patch
new file mode 100644
index 000000000000..8bf14c2944ba
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-osd-scrub_to_specifies_clone_ver_but_transaction_include.patch
@@ -0,0 +1,39 @@
+From 153f77544118613e19d5e88c030c3901234cf950 Mon Sep 17 00:00:00 2001
+From: David Zafman <dzafman@redhat.com>
+Date: Tue, 18 Jul 2017 15:08:14 -0700
+Subject: [PATCH] osd: scrub_to specifies clone ver, but transaction include
+ head write ver
+
+Fixes: http://tracker.ceph.com/issues/20041
+
+Signed-off-by: David Zafman <dzafman@redhat.com>
+(cherry picked from commit fd598a0d23d61c645633ae774c3404a43d035e3c)
+
+Conflicts:
+	src/osd/ReplicatedPG.cc (trivial)
+---
+ src/osd/ReplicatedPG.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/osd/ReplicatedPG.cc b/src/osd/ReplicatedPG.cc
+index 4b4dc34c602a..4d80ad1770e1 100644
+--- a/src/osd/ReplicatedPG.cc
++++ b/src/osd/ReplicatedPG.cc
+@@ -8318,7 +8318,7 @@ void ReplicatedPG::op_applied(const eversion_t &applied_version)
+   last_update_applied = applied_version;
+   if (is_primary()) {
+     if (scrubber.active) {
+-      if (last_update_applied == scrubber.subset_last_update) {
++      if (last_update_applied >= scrubber.subset_last_update) {
+         requeue_scrub();
+       }
+     } else {
+@@ -8326,7 +8326,7 @@ void ReplicatedPG::op_applied(const eversion_t &applied_version)
+     }
+   } else {
+     if (scrubber.active_rep_scrub) {
+-      if (last_update_applied == static_cast<MOSDRepScrub*>(
++      if (last_update_applied >= static_cast<MOSDRepScrub*>(
+ 	    scrubber.active_rep_scrub->get_req())->scrub_to) {
+ 	osd->op_wq.queue(
+ 	  make_pair(
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-rbd-do_not_attempt_to_load_key_if_auth_is_disabled.patch b/sys-cluster/ceph/files/ceph-10.2.9-rbd-do_not_attempt_to_load_key_if_auth_is_disabled.patch
new file mode 100644
index 000000000000..4b03e335bc58
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-rbd-do_not_attempt_to_load_key_if_auth_is_disabled.patch
@@ -0,0 +1,39 @@
+From 0cd7df3649d7486d444a61cab89c48a89ddd3e8d Mon Sep 17 00:00:00 2001
+From: Jason Dillaman <dillaman@redhat.com>
+Date: Thu, 29 Jun 2017 14:54:40 -0400
+Subject: [PATCH] rbd: do not attempt to load key if auth is disabled
+
+Fixes: http://tracker.ceph.com/issues/19035
+Signed-off-by: Jason Dillaman <dillaman@redhat.com>
+(cherry picked from commit 8b9c8df6d7f0b75c5451953bb322bc1f9afb6299)
+---
+ src/krbd.cc | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/src/krbd.cc b/src/krbd.cc
+index a0e546fa7f6f..2bb6b4270abd 100644
+--- a/src/krbd.cc
++++ b/src/krbd.cc
+@@ -129,13 +129,15 @@ static int build_map_buf(CephContext *cct, const char *pool, const char *image,
+   oss << " name=" << cct->_conf->name.get_id();
+ 
+   KeyRing keyring;
+-  r = keyring.from_ceph_context(cct);
+-  if (r == -ENOENT && !(cct->_conf->keyfile.length() ||
+-                        cct->_conf->key.length()))
+-    r = 0;
+-  if (r < 0) {
+-    cerr << "rbd: failed to get secret" << std::endl;
+-    return r;
++  if (cct->_conf->auth_client_required != "none") {
++    r = keyring.from_ceph_context(cct);
++    if (r == -ENOENT && !(cct->_conf->keyfile.length() ||
++                          cct->_conf->key.length()))
++      r = 0;
++    if (r < 0) {
++      cerr << "rbd: failed to get secret" << std::endl;
++      return r;
++    }
+   }
+ 
+   CryptoKey secret;
diff --git a/sys-cluster/ceph/files/ceph-10.2.9-unlock_sdata_op_ordering_lock_with_sdata_lock.patch b/sys-cluster/ceph/files/ceph-10.2.9-unlock_sdata_op_ordering_lock_with_sdata_lock.patch
new file mode 100644
index 000000000000..60f46ab36a40
--- /dev/null
+++ b/sys-cluster/ceph/files/ceph-10.2.9-unlock_sdata_op_ordering_lock_with_sdata_lock.patch
@@ -0,0 +1,32 @@
+From 3fa277b479d69699bf5a6875cd4a5efcf9ae0788 Mon Sep 17 00:00:00 2001
+From: Alexey Sheplyakov <asheplyakov@mirantis.com>
+Date: Tue, 27 Jun 2017 16:07:01 +0400
+Subject: [PATCH] jewel: osd: unlock sdata_op_ordering_lock with sdata_lock
+ hold to avoid missing wakeup signal
+
+Based on commit bc683385819146f3f6f096ceec97e1226a3cd237. The OSD code has
+been refactored a lot since Jewel, hence cherry-picking that patch introduces
+a lot of unrelated changes, and is much more difficult than reusing the idea.
+
+Fixes: http://tracker.ceph.com/issues/20428
+
+Signed-off-by: Alexey Sheplyakov <asheplyakov@mirantis.com>
+---
+ src/osd/OSD.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/osd/OSD.cc b/src/osd/OSD.cc
+index f5cfda3b686a..38a2711f6f92 100644
+--- a/src/osd/OSD.cc
++++ b/src/osd/OSD.cc
+@@ -8727,9 +8727,9 @@ void OSD::ShardedOpWQ::_process(uint32_t thread_index, heartbeat_handle_d *hb )
+   assert(NULL != sdata);
+   sdata->sdata_op_ordering_lock.Lock();
+   if (sdata->pqueue->empty()) {
+-    sdata->sdata_op_ordering_lock.Unlock();
+     osd->cct->get_heartbeat_map()->reset_timeout(hb, 4, 0);
+     sdata->sdata_lock.Lock();
++    sdata->sdata_op_ordering_lock.Unlock();
+     sdata->sdata_cond.WaitInterval(osd->cct, sdata->sdata_lock, utime_t(2, 0));
+     sdata->sdata_lock.Unlock();
+     sdata->sdata_op_ordering_lock.Lock();