diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 86206a7..be85d92 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2887,25 +2887,58 @@
 }
 
 /*
- * This fills in the pool_name, image_name, image_name_len, rbd_dev,
- * rbd_md_name, and name fields of the given rbd_dev, based on the
- * list of monitor addresses and other options provided via
- * /sys/bus/rbd/add.  Returns a pointer to a dynamically-allocated
- * copy of the snapshot name to map if successful, or a
- * pointer-coded error otherwise.
+ * Parse the options provided for an "rbd add" (i.e., rbd image
+ * mapping) request.  These arrive via a write to /sys/bus/rbd/add,
+ * and the data written is passed here via a NUL-terminated buffer.
+ * Returns 0 if successful or an error code otherwise.
  *
- * Note: rbd_dev is assumed to have been initially zero-filled.
+ * The information extracted from these options is recorded in
+ * the other parameters which return dynamically-allocated
+ * structures:
+ *  ceph_opts
+ *      The address of a pointer that will refer to a ceph options
+ *      structure.  Caller must release the returned pointer using
+ *      ceph_destroy_options() when it is no longer needed.
+ *  rbd_opts
+ *	Address of an rbd options pointer.  Fully initialized by
+ *	this function; caller must release with kfree().
+ *  spec
+ *	Address of an rbd image specification pointer.  Fully
+ *	initialized by this function based on parsed options.
+ *	Caller must release with rbd_spec_put().
+ *
+ * The options passed take this form:
+ *  <mon_addrs> <options> <pool_name> <image_name> [<snap_id>]
+ * where:
+ *  <mon_addrs>
+ *      A comma-separated list of one or more monitor addresses.
+ *      A monitor address is an ip address, optionally followed
+ *      by a port number (separated by a colon).
+ *        I.e.:  ip1[:port1][,ip2[:port2]...]
+ *  <options>
+ *      A comma-separated list of ceph and/or rbd options.
+ *  <pool_name>
+ *      The name of the rados pool containing the rbd image.
+ *  <image_name>
+ *      The name of the image in that pool to map.
+ *  <snap_id>
+ *      An optional snapshot id.  If provided, the mapping will
+ *      present data from the image at the time that snapshot was
+ *      created.  The image head is used if no snapshot id is
+ *      provided.  Snapshot mappings are always read-only.
  */
-static int rbd_add_parse_args(struct rbd_device *rbd_dev,
-				const char *buf,
+static int rbd_add_parse_args(const char *buf,
 				struct ceph_options **ceph_opts,
-				struct rbd_options **opts)
+				struct rbd_options **opts,
+				struct rbd_spec **rbd_spec)
 {
 	size_t len;
+	char *options;
 	const char *mon_addrs;
 	size_t mon_addrs_size;
-	char *options;
+	struct rbd_spec *spec = NULL;
 	struct rbd_options *rbd_opts = NULL;
+	struct ceph_options *copts;
 	int ret;
 
 	/* The first four tokens are required */
@@ -2924,17 +2957,20 @@
 	if (!*options)
 		goto out_err;	/* Missing options */
 
-	rbd_dev->spec->pool_name = dup_token(&buf, NULL);
-	if (!rbd_dev->spec->pool_name)
+	spec = rbd_spec_alloc();
+	if (!spec)
 		goto out_mem;
-	if (!*rbd_dev->spec->pool_name)
+
+	spec->pool_name = dup_token(&buf, NULL);
+	if (!spec->pool_name)
+		goto out_mem;
+	if (!*spec->pool_name)
 		goto out_err;	/* Missing pool name */
 
-	rbd_dev->spec->image_name =
-		dup_token(&buf, &rbd_dev->spec->image_name_len);
-	if (!rbd_dev->spec->image_name)
+	spec->image_name = dup_token(&buf, &spec->image_name_len);
+	if (!spec->image_name)
 		goto out_mem;
-	if (!*rbd_dev->spec->image_name)
+	if (!*spec->image_name)
 		goto out_err;	/* Missing image name */
 
 	/*
@@ -2949,11 +2985,11 @@
 		ret = -ENAMETOOLONG;
 		goto out_err;
 	}
-	rbd_dev->spec->snap_name = kmalloc(len + 1, GFP_KERNEL);
-	if (!rbd_dev->spec->snap_name)
+	spec->snap_name = kmalloc(len + 1, GFP_KERNEL);
+	if (!spec->snap_name)
 		goto out_mem;
-	memcpy(rbd_dev->spec->snap_name, buf, len);
-	*(rbd_dev->spec->snap_name + len) = '\0';
+	memcpy(spec->snap_name, buf, len);
+	*(spec->snap_name + len) = '\0';
 
 	/* Initialize all rbd options to the defaults */
 
@@ -2963,25 +2999,25 @@
 
 	rbd_opts->read_only = RBD_READ_ONLY_DEFAULT;
 
-	*ceph_opts = ceph_parse_options(options, mon_addrs,
+	copts = ceph_parse_options(options, mon_addrs,
 					mon_addrs + mon_addrs_size - 1,
 					parse_rbd_opts_token, rbd_opts);
-	kfree(options);
-	if (IS_ERR(*ceph_opts)) {
-		ret = PTR_ERR(*ceph_opts);
+	if (IS_ERR(copts)) {
+		ret = PTR_ERR(copts);
 		goto out_err;
 	}
+	kfree(options);
+
+	*ceph_opts = copts;
 	*opts = rbd_opts;
+	*rbd_spec = spec;
 
 	return 0;
 out_mem:
 	ret = -ENOMEM;
 out_err:
-	kfree(rbd_dev->spec->image_name);
-	rbd_dev->spec->image_name = NULL;
-	rbd_dev->spec->image_name_len = 0;
-	kfree(rbd_dev->spec->pool_name);
-	rbd_dev->spec->pool_name = NULL;
+	kfree(rbd_opts);
+	rbd_spec_put(spec);
 	kfree(options);
 
 	return ret;
@@ -3195,6 +3231,7 @@
 	struct rbd_device *rbd_dev = NULL;
 	struct ceph_options *ceph_opts = NULL;
 	struct rbd_options *rbd_opts = NULL;
+	struct rbd_spec *spec = NULL;
 	struct ceph_osd_client *osdc;
 	int rc = -ENOMEM;
 
@@ -3204,9 +3241,6 @@
 	rbd_dev = kzalloc(sizeof(*rbd_dev), GFP_KERNEL);
 	if (!rbd_dev)
 		return -ENOMEM;
-	rbd_dev->spec = rbd_spec_alloc();
-	if (!rbd_dev->spec)
-		goto err_out_mem;
 
 	/* static rbd_device initialization */
 	spin_lock_init(&rbd_dev->lock);
@@ -3215,9 +3249,10 @@
 	init_rwsem(&rbd_dev->header_rwsem);
 
 	/* parse add command */
-	rc = rbd_add_parse_args(rbd_dev, buf, &ceph_opts, &rbd_opts);
+	rc = rbd_add_parse_args(buf, &ceph_opts, &rbd_opts, &spec);
 	if (rc < 0)
 		goto err_out_mem;
+
 	rbd_dev->mapping.read_only = rbd_opts->read_only;
 
 	rc = rbd_get_client(rbd_dev, ceph_opts);
@@ -3227,10 +3262,12 @@
 
 	/* pick the pool */
 	osdc = &rbd_dev->rbd_client->client->osdc;
-	rc = ceph_pg_poolid_by_name(osdc->osdmap, rbd_dev->spec->pool_name);
+	rc = ceph_pg_poolid_by_name(osdc->osdmap, spec->pool_name);
 	if (rc < 0)
 		goto err_out_client;
-	rbd_dev->spec->pool_id = (u64) rc;
+	spec->pool_id = (u64) rc;
+
+	rbd_dev->spec = spec;
 
 	rc = rbd_dev_probe(rbd_dev);
 	if (rc < 0)
@@ -3321,8 +3358,8 @@
 	if (ceph_opts)
 		ceph_destroy_options(ceph_opts);
 	kfree(rbd_opts);
+	rbd_spec_put(spec);
 err_out_mem:
-	rbd_spec_put(rbd_dev->spec);
 	kfree(rbd_dev);
 
 	dout("Error adding device %s\n", buf);