Subject: proposed text for last call issue03

From: Mike Eisler <[email-masked]>
Date: Thu, 29 Aug 2002 10:33:43 -0700

The consensus appears to be that a complete solution is
not possible for this. There appears to be a consensus
around a partial solution proposed by Dave Noveck, which
is for RENEW to return NFS4ERR_RESOURCE to indicate that
the callback path from the server to client is down. Such
an indication will tell the client that his delegation is
in danger of being summarily revoked, so the client can,
before lease expires, flush modified data and locks to
the server.

The suggested edits below slightly modify the propsal. Instead of 
overloading NFS4ERR_RESOURCE, a new error, NFS4ERR_CB_PATH_DOWN,
will be returned by RENEW to indicate to the client that the
callback path is down, and that the delegation has been potentially
revoking (if not already revoked).

Also, I would argue that as specified below, the solution is
complete, since it provides a simple set of deterministic rules
for the client and server to honor to avoid the scenario
of this issue.

CHANGE:

   NFS4ERR_CLID_INUSE    The SETCLIENTID operation has found that a
                         client id is already in use by another client.

TO:

   NFS4ERR_CLID_INUSE    The SETCLIENTID operation has found that a
                         client id is already in use by another client.

   NFS4ERR_CB_PATH_DOWN  The callback path from the server to client is
                         currently down. Any delegations the client had
                         may have, or may soon be revoked.

ADD: (after section 9.4.4,  Recall of Open Delegation)

9.4.5. Clients that Fail to Honor Delegation Recalls

  A client may fail to respond to a recall for various reasons,
  such including a breakdown of the callback path from 
  server to the client. The client may be unaware of a breakdown in
  the callback path, and this lack of awareness could result in
  the client finding out long after the breakdown that its 
  delegation has been revoked, and another client has modified
  the data the client had a delegation for. This is especially a
  problem for the client that held a write delegation.

  The server also has a dilemma in that the client that fails to
  respond to the recall might also be sending other NFS requests,
  including those that renew the lease before the lease expires.
  Without returning an error for those lease renewing operations,
  the server leads the client to believe that the delegation it
  has is in force.

  This difficulty is solved by the following rules:

  o When the callback path is down, the server MUST NOT
    revoke the delegation one of the following occurs:

    - The client has issued a RENEW operation, and the
      server has returned an NFS4ERR_CB_PATH_DOWN
      error. The server MUST renew the lease for any record
      locks and share reservations the client has that the
      server known about (as opposed to those locks and
      share reservations the client has established but not
      yet sent tot he server, due to the delegation). The
      server SHOULD give the client a reasonable time to
      return its delegations to the server before revoking
      the client's delegations.

    - The client has not issued a RENEW operation for
      some period of time after the server attempted to
      recall the delegation.  This period of time MUST NOT
      be less than the value of the lease_time attribute.

  o When the client holds a delegation, it can not rely
    on operations, except for RENEW, that take a stateid,
    to renew delegation leases across callback path
    failures.  The client that wants to keep delegations
    in force across callback path failures must use RENEW
    to do so.

CHANGE, (in    14.2.28.  Operation 30: RENEW - Renew a Lease):

   IMPLEMENTATION

   ERRORS

     NFS4ERR_BADXDR

TO:

   IMPLEMENTATION

     When the client holds delegations, it needs to use
     RENEW to detect when the server has determined
     that the callback path is down. When the server
     has made such determination, only the RENEW
     operation will renew the lease on delegations. If
     the server determines the callback path is down, it
     returns NFS4ERR_CB_PATH_DOWN. Even though it returns
     NFS4ERR_CB_PATH_DOWN, the server MUST renew the lease
     on the record locks and share reservations that the
     client has established on the server. If for some
     reason the lock and share reservation lease cannot be
     renewed, then the server MUST return an error other
     than NFS4ERR_CB_PATH_DOWN, even if the callback path
     is also down.

   ERRORS

     NFS4ERR_BADXDR
     NFS4ERR_CB_PATH_DOWN

CHANGE:

           NFS4ERR_OP_ILLEGAL      = 10044,/* undefined operation     */
           NFS4ERR_DEADLOCK        = 10045,/* file locking deadlock   */
           NFS4ERR_FILE_OPEN       = 10046 /* open file blocks op.    */
   };

TO:

           NFS4ERR_OP_ILLEGAL      = 10044,/* undefined operation     */
           NFS4ERR_DEADLOCK        = 10045,/* file locking deadlock   */
           NFS4ERR_FILE_OPEN       = 10046, /* open file blocks op.    */
           NFS4ERR_CB_PATH_DOWN    = 10047 /* callback path down */
   };

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 29 Aug 2002 15:04:56 -0400

> revoking (if not already revoked).

I *really* prefer this idea.  I like having different errors for
indicating different events.  Overloading error semantics seems
like a bad idea if it is easily avoided (as here).

Ran
[email-masked]

---

From: "William A.(Andy) Adamson" <[email-masked]>
Date: Thu, 29 Aug 2002 16:18:10 -0400

>revoking (if not already revoked).

looks good mike!

-->Andy