nfsd4: fix minor memory leak
[safe/jmp/linux-2.6] / fs / nfsd / nfs4callback.c
index 324a278..4bc22c7 100644 (file)
@@ -1,6 +1,4 @@
 /*
- *  linux/fs/nfsd/nfs4callback.c
- *
  *  Copyright (c) 2001 The Regents of the University of Michigan.
  *  All rights reserved.
  *
  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <linux/module.h>
-#include <linux/list.h>
-#include <linux/inet.h>
-#include <linux/errno.h>
-#include <linux/delay.h>
-#include <linux/sunrpc/xdr.h>
-#include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/clnt.h>
-#include <linux/nfsd/nfsd.h>
-#include <linux/nfsd/state.h>
-#include <linux/sunrpc/sched.h>
-#include <linux/nfs4.h>
+#include "nfsd.h"
+#include "state.h"
 
 #define NFSDDBG_FACILITY                NFSDDBG_PROC
 
 #define NFSPROC4_CB_NULL 0
 #define NFSPROC4_CB_COMPOUND 1
-
-/* declarations */
-static const struct rpc_call_ops nfs4_cb_null_ops;
+#define NFS4_STATEID_SIZE 16
 
 /* Index of predefined Linux callback client operations */
 
 enum {
-        NFSPROC4_CLNT_CB_NULL = 0,
+       NFSPROC4_CLNT_CB_NULL = 0,
        NFSPROC4_CLNT_CB_RECALL,
+       NFSPROC4_CLNT_CB_SEQUENCE,
 };
 
 enum nfs_cb_opnum4 {
        OP_CB_RECALL            = 4,
+       OP_CB_SEQUENCE          = 11,
 };
 
 #define NFS4_MAXTAGLEN         20
@@ -71,22 +60,34 @@ enum nfs_cb_opnum4 {
 #define NFS4_dec_cb_null_sz            0
 #define cb_compound_enc_hdr_sz         4
 #define cb_compound_dec_hdr_sz         (3 + (NFS4_MAXTAGLEN >> 2))
+#define sessionid_sz                   (NFS4_MAX_SESSIONID_LEN >> 2)
+#define cb_sequence_enc_sz             (sessionid_sz + 4 +             \
+                                       1 /* no referring calls list yet */)
+#define cb_sequence_dec_sz             (op_dec_sz + sessionid_sz + 4)
+
 #define op_enc_sz                      1
 #define op_dec_sz                      2
 #define enc_nfs4_fh_sz                 (1 + (NFS4_FHSIZE >> 2))
-#define enc_stateid_sz                 16
+#define enc_stateid_sz                 (NFS4_STATEID_SIZE >> 2)
 #define NFS4_enc_cb_recall_sz          (cb_compound_enc_hdr_sz +       \
+                                       cb_sequence_enc_sz +            \
                                        1 + enc_stateid_sz +            \
                                        enc_nfs4_fh_sz)
 
 #define NFS4_dec_cb_recall_sz          (cb_compound_dec_hdr_sz  +      \
+                                       cb_sequence_dec_sz +            \
                                        op_dec_sz)
 
+struct nfs4_rpc_args {
+       void                            *args_op;
+       struct nfsd4_cb_sequence        args_seq;
+};
+
 /*
 * Generic encode routines from fs/nfs/nfs4xdr.c
 */
-static inline u32 *
-xdr_writemem(u32 *p, const void *ptr, int nbytes)
+static inline __be32 *
+xdr_writemem(__be32 *p, const void *ptr, int nbytes)
 {
        int tmp = XDR_QUADLEN(nbytes);
        if (!tmp)
@@ -102,7 +103,7 @@ xdr_writemem(u32 *p, const void *ptr, int nbytes)
 } while (0)
 #define RESERVE_SPACE(nbytes)   do {                            \
        p = xdr_reserve_space(xdr, nbytes);                     \
-       if (!p) dprintk("NFSD: RESERVE_SPACE(%d) failed in function %s\n", (int) (nbytes), __FUNCTION__); \
+       if (!p) dprintk("NFSD: RESERVE_SPACE(%d) failed in function %s\n", (int) (nbytes), __func__); \
        BUG_ON(!p);                                             \
 } while (0)
 
@@ -132,17 +133,21 @@ xdr_error:                                      \
        p = xdr_inline_decode(xdr, nbytes); \
        if (!p) { \
                dprintk("NFSD: %s: reply buffer overflowed in line %d.\n", \
-                       __FUNCTION__, __LINE__); \
+                       __func__, __LINE__); \
                return -EIO; \
        } \
 } while (0)
 
 struct nfs4_cb_compound_hdr {
-       int             status;
-       u32             ident;
+       /* args */
+       u32             ident;  /* minorversion 0 only */
        u32             nops;
+       __be32          *nops_p;
+       u32             minorversion;
+       /* res */
+       int             status;
        u32             taglen;
-       char *          tag;
+       char            *tag;
 };
 
 static struct {
@@ -202,36 +207,64 @@ nfs_cb_stat_to_errno(int stat)
  * XDR encode
  */
 
-static int
+static void
 encode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr)
 {
-       u32 * p;
+       __be32 * p;
 
        RESERVE_SPACE(16);
        WRITE32(0);            /* tag length is always 0 */
-       WRITE32(NFS4_MINOR_VERSION);
+       WRITE32(hdr->minorversion);
        WRITE32(hdr->ident);
+       hdr->nops_p = p;
        WRITE32(hdr->nops);
-       return 0;
 }
 
-static int
-encode_cb_recall(struct xdr_stream *xdr, struct nfs4_cb_recall *cb_rec)
+static void encode_cb_nops(struct nfs4_cb_compound_hdr *hdr)
+{
+       *hdr->nops_p = htonl(hdr->nops);
+}
+
+static void
+encode_cb_recall(struct xdr_stream *xdr, struct nfs4_delegation *dp,
+               struct nfs4_cb_compound_hdr *hdr)
 {
-       u32 *p;
-       int len = cb_rec->cbr_fhlen;
+       __be32 *p;
+       int len = dp->dl_fh.fh_size;
 
-       RESERVE_SPACE(12+sizeof(cb_rec->cbr_stateid) + len);
+       RESERVE_SPACE(12+sizeof(dp->dl_stateid) + len);
        WRITE32(OP_CB_RECALL);
-       WRITEMEM(&cb_rec->cbr_stateid, sizeof(stateid_t));
-       WRITE32(cb_rec->cbr_trunc);
+       WRITE32(dp->dl_stateid.si_generation);
+       WRITEMEM(&dp->dl_stateid.si_opaque, sizeof(stateid_opaque_t));
+       WRITE32(0); /* truncate optimization not implemented */
        WRITE32(len);
-       WRITEMEM(cb_rec->cbr_fhval, len);
-       return 0;
+       WRITEMEM(&dp->dl_fh.fh_base, len);
+       hdr->nops++;
+}
+
+static void
+encode_cb_sequence(struct xdr_stream *xdr, struct nfsd4_cb_sequence *args,
+                  struct nfs4_cb_compound_hdr *hdr)
+{
+       __be32 *p;
+
+       if (hdr->minorversion == 0)
+               return;
+
+       RESERVE_SPACE(1 + NFS4_MAX_SESSIONID_LEN + 20);
+
+       WRITE32(OP_CB_SEQUENCE);
+       WRITEMEM(args->cbs_clp->cl_sessionid.data, NFS4_MAX_SESSIONID_LEN);
+       WRITE32(args->cbs_clp->cl_cb_seq_nr);
+       WRITE32(0);             /* slotid, always 0 */
+       WRITE32(0);             /* highest slotid always 0 */
+       WRITE32(0);             /* cachethis always 0 */
+       WRITE32(0); /* FIXME: support referring_call_lists */
+       hdr->nops++;
 }
 
 static int
-nfs4_xdr_enc_cb_null(struct rpc_rqst *req, u32 *p)
+nfs4_xdr_enc_cb_null(struct rpc_rqst *req, __be32 *p)
 {
        struct xdr_stream xdrs, *xdr = &xdrs;
 
@@ -241,23 +274,28 @@ nfs4_xdr_enc_cb_null(struct rpc_rqst *req, u32 *p)
 }
 
 static int
-nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, u32 *p, struct nfs4_cb_recall *args)
+nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, __be32 *p,
+               struct nfs4_rpc_args *rpc_args)
 {
        struct xdr_stream xdr;
+       struct nfs4_delegation *args = rpc_args->args_op;
        struct nfs4_cb_compound_hdr hdr = {
-               .ident = args->cbr_ident,
-               .nops   = 1,
+               .ident = args->dl_ident,
+               .minorversion = rpc_args->args_seq.cbs_minorversion,
        };
 
        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
        encode_cb_compound_hdr(&xdr, &hdr);
-       return (encode_cb_recall(&xdr, args));
+       encode_cb_sequence(&xdr, &rpc_args->args_seq, &hdr);
+       encode_cb_recall(&xdr, args, &hdr);
+       encode_cb_nops(&hdr);
+       return 0;
 }
 
 
 static int
 decode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr){
-        u32 *p;
+        __be32 *p;
 
         READ_BUF(8);
         READ32(hdr->status);
@@ -272,7 +310,7 @@ decode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr)
 static int
 decode_cb_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
 {
-       u32 *p;
+       __be32 *p;
        u32 op;
        int32_t nfserr;
 
@@ -290,14 +328,66 @@ decode_cb_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
        return 0;
 }
 
+/*
+ * Our current back channel implmentation supports a single backchannel
+ * with a single slot.
+ */
 static int
-nfs4_xdr_dec_cb_null(struct rpc_rqst *req, u32 *p)
+decode_cb_sequence(struct xdr_stream *xdr, struct nfsd4_cb_sequence *res,
+                  struct rpc_rqst *rqstp)
+{
+       struct nfs4_sessionid id;
+       int status;
+       u32 dummy;
+       __be32 *p;
+
+       if (res->cbs_minorversion == 0)
+               return 0;
+
+       status = decode_cb_op_hdr(xdr, OP_CB_SEQUENCE);
+       if (status)
+               return status;
+
+       /*
+        * If the server returns different values for sessionID, slotID or
+        * sequence number, the server is looney tunes.
+        */
+       status = -ESERVERFAULT;
+
+       READ_BUF(NFS4_MAX_SESSIONID_LEN + 16);
+       memcpy(id.data, p, NFS4_MAX_SESSIONID_LEN);
+       p += XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN);
+       if (memcmp(id.data, res->cbs_clp->cl_sessionid.data,
+                  NFS4_MAX_SESSIONID_LEN)) {
+               dprintk("%s Invalid session id\n", __func__);
+               goto out;
+       }
+       READ32(dummy);
+       if (dummy != res->cbs_clp->cl_cb_seq_nr) {
+               dprintk("%s Invalid sequence number\n", __func__);
+               goto out;
+       }
+       READ32(dummy);  /* slotid must be 0 */
+       if (dummy != 0) {
+               dprintk("%s Invalid slotid\n", __func__);
+               goto out;
+       }
+       /* FIXME: process highest slotid and target highest slotid */
+       status = 0;
+out:
+       return status;
+}
+
+
+static int
+nfs4_xdr_dec_cb_null(struct rpc_rqst *req, __be32 *p)
 {
        return 0;
 }
 
 static int
-nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp, u32 *p)
+nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp, __be32 *p,
+               struct nfsd4_cb_sequence *seq)
 {
        struct xdr_stream xdr;
        struct nfs4_cb_compound_hdr hdr;
@@ -307,6 +397,11 @@ nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp, u32 *p)
        status = decode_cb_compound_hdr(&xdr, &hdr);
        if (status)
                goto out;
+       if (seq) {
+               status = decode_cb_sequence(&xdr, seq, rqstp);
+               if (status)
+                       goto out;
+       }
        status = decode_cb_op_hdr(&xdr, OP_CB_RECALL);
 out:
        return status;
@@ -315,16 +410,13 @@ out:
 /*
  * RPC procedure tables
  */
-#ifndef MAX
-# define MAX(a, b)      (((a) > (b))? (a) : (b))
-#endif
-
 #define PROC(proc, call, argtype, restype)                              \
 [NFSPROC4_CLNT_##proc] = {                                             \
         .p_proc   = NFSPROC4_CB_##call,                                        \
         .p_encode = (kxdrproc_t) nfs4_xdr_##argtype,                    \
         .p_decode = (kxdrproc_t) nfs4_xdr_##restype,                    \
-        .p_bufsiz = MAX(NFS4_##argtype##_sz,NFS4_##restype##_sz) << 2,  \
+        .p_arglen = NFS4_##argtype##_sz,                                \
+        .p_replen = NFS4_##restype##_sz,                                \
         .p_statidx = NFSPROC4_CB_##call,                               \
        .p_name   = #proc,                                              \
 }
@@ -345,192 +437,302 @@ static struct rpc_version *     nfs_cb_version[] = {
        &nfs_cb_version4,
 };
 
-/*
- * Use the SETCLIENTID credential
- */
-static struct rpc_cred *
-nfsd4_lookupcred(struct nfs4_client *clp, int taskflags)
+static struct rpc_program cb_program;
+
+static struct rpc_stat cb_stats = {
+               .program        = &cb_program
+};
+
+#define NFS4_CALLBACK 0x40000000
+static struct rpc_program cb_program = {
+               .name           = "nfs4_cb",
+               .number         = NFS4_CALLBACK,
+               .nrvers         = ARRAY_SIZE(nfs_cb_version),
+               .version        = nfs_cb_version,
+               .stats          = &cb_stats,
+               .pipe_dir_name  = "/nfsd4_cb",
+};
+
+static int max_cb_time(void)
 {
-        struct auth_cred acred;
-       struct rpc_clnt *clnt = clp->cl_callback.cb_client;
-       struct rpc_cred *ret;
-
-        get_group_info(clp->cl_cred.cr_group_info);
-        acred.uid = clp->cl_cred.cr_uid;
-        acred.gid = clp->cl_cred.cr_gid;
-        acred.group_info = clp->cl_cred.cr_group_info;
-
-        dprintk("NFSD:     looking up %s cred\n",
-                clnt->cl_auth->au_ops->au_name);
-        ret = rpcauth_lookup_credcache(clnt->cl_auth, &acred, taskflags);
-        put_group_info(clp->cl_cred.cr_group_info);
-        return ret;
+       return max(NFSD_LEASE_TIME/10, (time_t)1) * HZ;
 }
 
-/*
- * Set up the callback client and put a NFSPROC4_CB_NULL on the wire...
- */
-void
-nfsd4_probe_callback(struct nfs4_client *clp)
+/* Reference counting, callback cleanup, etc., all look racy as heck.
+ * And why is cb_set an atomic? */
+
+int setup_callback_client(struct nfs4_client *clp)
 {
-       struct sockaddr_in      addr;
-       struct nfs4_callback    *cb = &clp->cl_callback;
+       struct nfs4_cb_conn *cb = &clp->cl_cb_conn;
        struct rpc_timeout      timeparms = {
-               .to_initval     = (NFSD_LEASE_TIME/4) * HZ,
-               .to_retries     = 5,
-               .to_maxval      = (NFSD_LEASE_TIME/2) * HZ,
-               .to_exponential = 1,
+               .to_initval     = max_cb_time(),
+               .to_retries     = 0,
        };
-       struct rpc_program *    program = &cb->cb_program;
        struct rpc_create_args args = {
-               .protocol       = IPPROTO_TCP,
-               .address        = (struct sockaddr *)&addr,
-               .addrsize       = sizeof(addr),
+               .protocol       = XPRT_TRANSPORT_TCP,
+               .address        = (struct sockaddr *) &cb->cb_addr,
+               .addrsize       = cb->cb_addrlen,
                .timeout        = &timeparms,
-               .servername     = clp->cl_name.data,
-               .program        = program,
+               .program        = &cb_program,
+               .prognumber     = cb->cb_prog,
                .version        = nfs_cb_version[1]->number,
-               .authflavor     = RPC_AUTH_UNIX,        /* XXX: need AUTH_GSS... */
-               .flags          = (RPC_CLNT_CREATE_NOPING),
+               .authflavor     = clp->cl_flavor,
+               .flags          = (RPC_CLNT_CREATE_NOPING | RPC_CLNT_CREATE_QUIET),
+               .client_name    = clp->cl_principal,
        };
+       struct rpc_clnt *client;
+
+       if (!clp->cl_principal && (clp->cl_flavor >= RPC_AUTH_GSS_KRB5))
+               return -EINVAL;
+       if (cb->cb_minorversion) {
+               args.bc_xprt = clp->cl_cb_xprt;
+               args.protocol = XPRT_TRANSPORT_BC_TCP;
+       }
+       /* Create RPC client */
+       client = rpc_create(&args);
+       if (IS_ERR(client)) {
+               dprintk("NFSD: couldn't create callback client: %ld\n",
+                       PTR_ERR(client));
+               return PTR_ERR(client);
+       }
+       cb->cb_client = client;
+       return 0;
+
+}
+
+static void warn_no_callback_path(struct nfs4_client *clp, int reason)
+{
+       dprintk("NFSD: warning: no callback path to client %.*s: error %d\n",
+               (int)clp->cl_name.len, clp->cl_name.data, reason);
+}
+
+static void nfsd4_cb_probe_done(struct rpc_task *task, void *calldata)
+{
+       struct nfs4_client *clp = calldata;
+
+       if (task->tk_status)
+               warn_no_callback_path(clp, task->tk_status);
+       else
+               atomic_set(&clp->cl_cb_conn.cb_set, 1);
+       put_nfs4_client(clp);
+}
+
+static const struct rpc_call_ops nfsd4_cb_probe_ops = {
+       .rpc_call_done = nfsd4_cb_probe_done,
+};
+
+static struct rpc_cred *callback_cred;
+
+int set_callback_cred(void)
+{
+       if (callback_cred)
+               return 0;
+       callback_cred = rpc_lookup_machine_cred();
+       if (!callback_cred)
+               return -ENOMEM;
+       return 0;
+}
+
+
+void do_probe_callback(struct nfs4_client *clp)
+{
+       struct nfs4_cb_conn *cb = &clp->cl_cb_conn;
        struct rpc_message msg = {
                .rpc_proc       = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_NULL],
                .rpc_argp       = clp,
+               .rpc_cred       = callback_cred
        };
        int status;
 
-       if (atomic_read(&cb->cb_set))
+       status = rpc_call_async(cb->cb_client, &msg,
+                               RPC_TASK_SOFT | RPC_TASK_SOFTCONN,
+                               &nfsd4_cb_probe_ops, (void *)clp);
+       if (status) {
+               warn_no_callback_path(clp, status);
+               put_nfs4_client(clp);
+       }
+}
+
+/*
+ * Set up the callback client and put a NFSPROC4_CB_NULL on the wire...
+ */
+void
+nfsd4_probe_callback(struct nfs4_client *clp)
+{
+       int status;
+
+       BUG_ON(atomic_read(&clp->cl_cb_conn.cb_set));
+
+       status = setup_callback_client(clp);
+       if (status) {
+               warn_no_callback_path(clp, status);
                return;
+       }
+
+       /* the task holds a reference to the nfs4_client struct */
+       atomic_inc(&clp->cl_count);
 
-       /* Initialize address */
-       memset(&addr, 0, sizeof(addr));
-       addr.sin_family = AF_INET;
-       addr.sin_port = htons(cb->cb_port);
-       addr.sin_addr.s_addr = htonl(cb->cb_addr);
+       do_probe_callback(clp);
+}
 
-       /* Initialize rpc_program */
-       program->name = "nfs4_cb";
-       program->number = cb->cb_prog;
-       program->nrvers = ARRAY_SIZE(nfs_cb_version);
-       program->version = nfs_cb_version;
-       program->stats = &cb->cb_stat;
+/*
+ * There's currently a single callback channel slot.
+ * If the slot is available, then mark it busy.  Otherwise, set the
+ * thread for sleeping on the callback RPC wait queue.
+ */
+static int nfsd41_cb_setup_sequence(struct nfs4_client *clp,
+               struct rpc_task *task)
+{
+       struct nfs4_rpc_args *args = task->tk_msg.rpc_argp;
+       u32 *ptr = (u32 *)clp->cl_sessionid.data;
+       int status = 0;
 
-       /* Initialize rpc_stat */
-       memset(program->stats, 0, sizeof(cb->cb_stat));
-       program->stats->program = program;
+       dprintk("%s: %u:%u:%u:%u\n", __func__,
+               ptr[0], ptr[1], ptr[2], ptr[3]);
 
-       /* Create RPC client */
-       cb->cb_client = rpc_create(&args);
-       if (IS_ERR(cb->cb_client)) {
-               dprintk("NFSD: couldn't create callback client\n");
-               goto out_err;
+       if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+               rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
+               dprintk("%s slot is busy\n", __func__);
+               status = -EAGAIN;
+               goto out;
        }
 
-       /* Kick rpciod, put the call on the wire. */
-       if (rpciod_up() != 0)
-               goto out_clnt;
+       /*
+        * We'll need the clp during XDR encoding and decoding,
+        * and the sequence during decoding to verify the reply
+        */
+       args->args_seq.cbs_clp = clp;
+       task->tk_msg.rpc_resp = &args->args_seq;
 
-       /* the task holds a reference to the nfs4_client struct */
-       atomic_inc(&clp->cl_count);
+out:
+       dprintk("%s status=%d\n", __func__, status);
+       return status;
+}
 
-       msg.rpc_cred = nfsd4_lookupcred(clp,0);
-       if (IS_ERR(msg.rpc_cred))
-               goto out_rpciod;
-       status = rpc_call_async(cb->cb_client, &msg, RPC_TASK_ASYNC, &nfs4_cb_null_ops, NULL);
-       put_rpccred(msg.rpc_cred);
+/*
+ * TODO: cb_sequence should support referring call lists, cachethis, multiple
+ * slots, and mark callback channel down on communication errors.
+ */
+static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
+{
+       struct nfs4_delegation *dp = calldata;
+       struct nfs4_client *clp = dp->dl_client;
+       struct nfs4_rpc_args *args = task->tk_msg.rpc_argp;
+       u32 minorversion = clp->cl_cb_conn.cb_minorversion;
+       int status = 0;
 
-       if (status != 0) {
-               dprintk("NFSD: asynchronous NFSPROC4_CB_NULL failed!\n");
-               goto out_rpciod;
+       args->args_seq.cbs_minorversion = minorversion;
+       if (minorversion) {
+               status = nfsd41_cb_setup_sequence(clp, task);
+               if (status) {
+                       if (status != -EAGAIN) {
+                               /* terminate rpc task */
+                               task->tk_status = status;
+                               task->tk_action = NULL;
+                       }
+                       return;
+               }
        }
-       return;
-
-out_rpciod:
-       atomic_dec(&clp->cl_count);
-       rpciod_down();
-out_clnt:
-       rpc_shutdown_client(cb->cb_client);
-out_err:
-       cb->cb_client = NULL;
-       dprintk("NFSD: warning: no callback path to client %.*s\n",
-               (int)clp->cl_name.len, clp->cl_name.data);
+       rpc_call_start(task);
 }
 
-static void
-nfs4_cb_null(struct rpc_task *task, void *dummy)
+static void nfsd4_cb_done(struct rpc_task *task, void *calldata)
 {
-       struct nfs4_client *clp = (struct nfs4_client *)task->tk_msg.rpc_argp;
-       struct nfs4_callback *cb = &clp->cl_callback;
-       u32 addr = htonl(cb->cb_addr);
+       struct nfs4_delegation *dp = calldata;
+       struct nfs4_client *clp = dp->dl_client;
 
-       dprintk("NFSD: nfs4_cb_null task->tk_status %d\n", task->tk_status);
+       dprintk("%s: minorversion=%d\n", __func__,
+               clp->cl_cb_conn.cb_minorversion);
 
-       if (task->tk_status < 0) {
-               dprintk("NFSD: callback establishment to client %.*s failed\n",
-                       (int)clp->cl_name.len, clp->cl_name.data);
-               goto out;
+       if (clp->cl_cb_conn.cb_minorversion) {
+               /* No need for lock, access serialized in nfsd4_cb_prepare */
+               ++clp->cl_cb_seq_nr;
+               clear_bit(0, &clp->cl_cb_slot_busy);
+               rpc_wake_up_next(&clp->cl_cb_waitq);
+               dprintk("%s: freed slot, new seqid=%d\n", __func__,
+                       clp->cl_cb_seq_nr);
+
+               /* We're done looking into the sequence information */
+               task->tk_msg.rpc_resp = NULL;
        }
-       atomic_set(&cb->cb_set, 1);
-       dprintk("NFSD: callback set to client %u.%u.%u.%u\n", NIPQUAD(addr));
-out:
+}
+
+static void nfsd4_cb_recall_done(struct rpc_task *task, void *calldata)
+{
+       struct nfs4_delegation *dp = calldata;
+       struct nfs4_client *clp = dp->dl_client;
+
+       nfsd4_cb_done(task, calldata);
+
+       switch (task->tk_status) {
+       case -EIO:
+               /* Network partition? */
+               atomic_set(&clp->cl_cb_conn.cb_set, 0);
+               warn_no_callback_path(clp, task->tk_status);
+       case -EBADHANDLE:
+       case -NFS4ERR_BAD_STATEID:
+               /* Race: client probably got cb_recall
+                * before open reply granting delegation */
+               break;
+       default:
+               /* success, or error we can't handle */
+               goto done;
+       }
+       if (dp->dl_retries--) {
+               rpc_delay(task, 2*HZ);
+               task->tk_status = 0;
+               rpc_restart_call(task);
+               return;
+       } else {
+               atomic_set(&clp->cl_cb_conn.cb_set, 0);
+               warn_no_callback_path(clp, task->tk_status);
+       }
+done:
+       kfree(task->tk_msg.rpc_argp);
+}
+
+static void nfsd4_cb_recall_release(void *calldata)
+{
+       struct nfs4_delegation *dp = calldata;
+       struct nfs4_client *clp = dp->dl_client;
+
+       nfs4_put_delegation(dp);
        put_nfs4_client(clp);
 }
 
-static const struct rpc_call_ops nfs4_cb_null_ops = {
-       .rpc_call_done = nfs4_cb_null,
+static const struct rpc_call_ops nfsd4_cb_recall_ops = {
+       .rpc_call_prepare = nfsd4_cb_prepare,
+       .rpc_call_done = nfsd4_cb_recall_done,
+       .rpc_release = nfsd4_cb_recall_release,
 };
 
 /*
  * called with dp->dl_count inc'ed.
- * nfs4_lock_state() may or may not have been called.
  */
 void
 nfsd4_cb_recall(struct nfs4_delegation *dp)
 {
        struct nfs4_client *clp = dp->dl_client;
-       struct rpc_clnt *clnt = clp->cl_callback.cb_client;
-       struct nfs4_cb_recall *cbr = &dp->dl_recall;
+       struct rpc_clnt *clnt = clp->cl_cb_conn.cb_client;
+       struct nfs4_rpc_args *args;
        struct rpc_message msg = {
                .rpc_proc = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_RECALL],
-               .rpc_argp = cbr,
+               .rpc_cred = callback_cred
        };
-       int retries = 1;
-       int status = 0;
+       int status = -ENOMEM;
 
-       if ((!atomic_read(&clp->cl_callback.cb_set)) || !clnt)
-               return;
-
-       msg.rpc_cred = nfsd4_lookupcred(clp, 0);
-       if (IS_ERR(msg.rpc_cred))
+       args = kzalloc(sizeof(*args), GFP_KERNEL);
+       if (!args)
                goto out;
-
-       cbr->cbr_trunc = 0; /* XXX need to implement truncate optimization */
-       cbr->cbr_dp = dp;
-
-       status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFT);
-       while (retries--) {
-               switch (status) {
-                       case -EIO:
-                               /* Network partition? */
-                       case -EBADHANDLE:
-                       case -NFS4ERR_BAD_STATEID:
-                               /* Race: client probably got cb_recall
-                                * before open reply granting delegation */
-                               break;
-                       default:
-                               goto out_put_cred;
-               }
-               ssleep(2);
-               status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFT);
-       }
-out_put_cred:
-       put_rpccred(msg.rpc_cred);
+       args->args_op = dp;
+       msg.rpc_argp = args;
+       dp->dl_retries = 1;
+       status = rpc_call_async(clnt, &msg, RPC_TASK_SOFT,
+                               &nfsd4_cb_recall_ops, dp);
 out:
-       if (status == -EIO)
-               atomic_set(&clp->cl_callback.cb_set, 0);
-       /* Success or failure, now we're either waiting for lease expiration
-        * or deleg_return. */
-       dprintk("NFSD: nfs4_cb_recall: dp %p dl_flock %p dl_count %d\n",dp, dp->dl_flock, atomic_read(&dp->dl_count));
-       nfs4_put_delegation(dp);
-       return;
+       if (status) {
+               kfree(args);
+               put_nfs4_client(clp);
+               nfs4_put_delegation(dp);
+       }
 }