how can the nfs timer work?

[Antti Kantee <pooka%cs.hut.fi@localhost>]

Hi,

I've been trying to figure out why the nfs timer (nfs_timer() in
nfs_socket.c) works.

1) I don't really see what good splsoftnet does, as the queue is
   never messed with in network interrupt context AFAICT.  Even if
   this holds for the queue, there is nothing protecting the actual
   requests apart from biglock.
2) It does a call to solock(), which pretty clearly can block and
   therefore the request currently being processed can be invalidated
   and freed during the call to solock().  (are callouts even allowed
   to block??)

I see crashes pretty much immediately if I stress rump_nfs.  If I add some
primitive form of synchronization, the problems go away.  But I'm really
curious why this doesn't trigger in the kernel pretty much instantly.
Note: I don't run a -current kernel, but I can't remember seeing any
great complaints about a non-functional nfs client on the lists either.
Is kmem somehow forgiving with dangling pointers or is it actually
supposed to work for whatever reason I can't figure out?