Outside of USB, no code is executed in a softnet interrupt context. So what's protecting NFS data structures is the KERNEL_LOCK().
But more importantly, since r1.114 of nfs_socket.c, the 'softnet' thread is no longer executing NFS code. So all these splsoftnet() can disappear. Ok? Index: nfs/nfs_socket.c =================================================================== RCS file: /cvs/src/sys/nfs/nfs_socket.c,v retrieving revision 1.115 diff -u -p -r1.115 nfs_socket.c --- nfs/nfs_socket.c 8 May 2017 09:11:20 -0000 1.115 +++ nfs/nfs_socket.c 15 May 2017 11:11:27 -0000 @@ -394,7 +394,7 @@ nfs_reconnect(struct nfsreq *rep) { struct nfsreq *rp; struct nfsmount *nmp = rep->r_nmp; - int s, error; + int error; nfs_disconnect(nmp); while ((error = nfs_connect(nmp, rep)) != 0) { @@ -407,12 +407,10 @@ nfs_reconnect(struct nfsreq *rep) * Loop through outstanding request list and fix up all requests * on old socket. */ - s = splsoftnet(); TAILQ_FOREACH(rp, &nmp->nm_reqsq, r_chain) { rp->r_flags |= R_MUSTRESEND; rp->r_rexmit = 0; } - splx(s); return (0); } @@ -737,7 +735,7 @@ nfs_reply(struct nfsreq *myrep) struct mbuf *nam; u_int32_t rxid, *tl, t1; caddr_t cp2; - int s, error; + int error; /* * Loop around until we get our own reply @@ -790,7 +788,6 @@ nfsmout: * Loop through the request list to match up the reply * Iff no match, just drop the datagram */ - s = splsoftnet(); TAILQ_FOREACH(rep, &nmp->nm_reqsq, r_chain) { if (rep->r_mrep == NULL && rxid == rep->r_xid) { /* Found it.. */ @@ -820,7 +817,6 @@ nfsmout: break; } } - splx(s); /* * If not matched to a request, drop it. * If it's mine, get out. @@ -854,7 +850,7 @@ nfs_request(struct vnode *vp, int procnu struct nfsmount *nmp; struct timeval tv; caddr_t cp2; - int t1, i, s, error = 0; + int t1, i, error = 0; int trylater_delay; struct nfsreq *rep; int mrest_len; @@ -911,7 +907,6 @@ tryagain: * Chain request into list of outstanding requests. Be sure * to put it LAST so timer finds oldest requests first. */ - s = splsoftnet(); if (TAILQ_EMPTY(&nmp->nm_reqsq)) timeout_add(&nmp->nm_rtimeout, nfs_ticks); TAILQ_INSERT_TAIL(&nmp->nm_reqsq, rep, r_chain); @@ -924,7 +919,6 @@ tryagain: if (nmp->nm_so && (nmp->nm_sotype != SOCK_DGRAM || (nmp->nm_flag & NFSMNT_DUMBTIMR) || nmp->nm_sent < nmp->nm_cwnd)) { - splx(s); if (nmp->nm_soflags & PR_CONNREQUIRED) error = nfs_sndlock(&nmp->nm_flag, rep); if (!error) { @@ -939,7 +933,6 @@ tryagain: rep->r_flags |= R_SENT; } } else { - splx(s); rep->r_rtt = -1; } @@ -952,11 +945,9 @@ tryagain: /* * RPC done, unlink the request. */ - s = splsoftnet(); TAILQ_REMOVE(&nmp->nm_reqsq, rep, r_chain); if (TAILQ_EMPTY(&nmp->nm_reqsq)) timeout_del(&nmp->nm_rtimeout); - splx(s); /* * Decrement the outstanding request count. Index: nfs/nfs_syscalls.c =================================================================== RCS file: /cvs/src/sys/nfs/nfs_syscalls.c,v retrieving revision 1.107 diff -u -p -r1.107 nfs_syscalls.c --- nfs/nfs_syscalls.c 22 Feb 2017 11:42:46 -0000 1.107 +++ nfs/nfs_syscalls.c 15 May 2017 11:11:27 -0000 @@ -229,7 +229,7 @@ nfssvc_addsock(struct file *fp, struct m struct nfssvc_sock *slp; struct socket *so; struct nfssvc_sock *tslp; - int error, s; + int error; so = (struct socket *)fp->f_data; tslp = NULL; @@ -286,12 +286,10 @@ nfssvc_addsock(struct file *fp, struct m slp->ns_nam = mynam; fp->f_count++; slp->ns_fp = fp; - s = splsoftnet(); so->so_upcallarg = (caddr_t)slp; so->so_upcall = nfsrv_rcv; slp->ns_flag = (SLP_VALID | SLP_NEEDQ); nfsrv_wakenfsd(slp); - splx(s); return (0); } @@ -309,11 +307,10 @@ nfssvc_nfsd(struct nfsd *nfsd) int *solockp; struct nfsrv_descript *nd = NULL; struct mbuf *mreq; - int error = 0, cacherep, s, sotype; + int error = 0, cacherep, sotype; cacherep = RC_DOIT; - s = splsoftnet(); TAILQ_INSERT_TAIL(&nfsd_head, nfsd, nfsd_chain); nfs_numnfsd++; @@ -357,8 +354,6 @@ loop: goto loop; } - splx(s); - so = slp->ns_so; sotype = so->so_type; if (ISSET(so->so_proto->pr_flags, PR_CONNREQUIRED)) @@ -434,7 +429,6 @@ loop: if (error == EINTR || error == ERESTART) { pool_put(&nfsrv_descript_pl, nd); nfsrv_slpderef(slp); - s = splsoftnet(); goto done; } break; @@ -449,7 +443,6 @@ loop: nd = NULL; } - s = splsoftnet(); if (nfsrv_dorec(slp, nfsd, &nd)) { nfsd->nfsd_flag &= ~NFSD_REQINPROG; nfsd->nfsd_slp = NULL; @@ -459,7 +452,6 @@ loop: done: TAILQ_REMOVE(&nfsd_head, nfsd, nfsd_chain); - splx(s); free(nfsd, M_NFSD, sizeof(*nfsd)); if (--nfs_numnfsd == 0) nfsrv_init(1); /* Reinitialize everything */ Index: nfs/nfs_vfsops.c =================================================================== RCS file: /cvs/src/sys/nfs/nfs_vfsops.c,v retrieving revision 1.113 diff -u -p -r1.113 nfs_vfsops.c --- nfs/nfs_vfsops.c 22 Feb 2017 11:42:46 -0000 1.113 +++ nfs/nfs_vfsops.c 15 May 2017 11:11:27 -0000 @@ -403,12 +403,9 @@ void nfs_decode_args(struct nfsmount *nmp, struct nfs_args *argp, struct nfs_args *nargp) { - int s; int adjsock = 0; int maxio; - s = splsoftnet(); - #if 0 /* Re-bind if rsrvd port requested and wasn't on one */ adjsock = !(nmp->nm_flag & NFSMNT_RESVPORT) @@ -418,10 +415,8 @@ nfs_decode_args(struct nfsmount *nmp, st adjsock |= ((nmp->nm_flag & NFSMNT_NOCONN) != (argp->flags & NFSMNT_NOCONN)); - /* Update flags atomically. Don't change the lock bits. */ nmp->nm_flag = (argp->flags & ~NFSMNT_INTERNAL) | (nmp->nm_flag & NFSMNT_INTERNAL); - splx(s); if ((argp->flags & NFSMNT_TIMEO) && argp->timeo > 0) { nmp->nm_timeo = (argp->timeo * NFS_HZ + 5) / 10;