illumos gate

Here is the setup in which I can reproduce the panic 100% of the time:

- NFS server running Solaris 11.2.
- NFS client: A native zone on a SmartOS joyent_20141030T164802Z host.
- NFS filesystem mounted via automount (my home directory)
- connected via IPv4 and IPv6; NFS mount is via TCP v6

On the illumos-based NFS client machine:
$ cd /into/nfs/mounted/dir
$ touch foo
$ mv foo foo2
panic!

BAD TRAP: type=e (#pf Page fault) rp=ffffff008d66e940 addr=2e3031a8 occurred in
module "genunix" due to an illegal access to a user address

See the attached crash dump. I note this in the stack trace for the crashing mv command:

...
    die+0xdf(e, ffffff008d66e940, 2e3031a8, 4)
    trap+0xdb3(ffffff008d66e940, 2e3031a8, 4)
    0xfffffffffb8001d6()
    vnevent_rename_src+0x39(2e303130, ffffff13954cac80, ffffff13871546c0, 0)
    nfs4rename+0x344(ffffff13954cac80, ffffff13871546c0, ffffff13a4c68880, 
    ffffff1386b704e3, ffffff1388caa3e8, 0)
    nfs4_rename+0xae(ffffff13954cac80, ffffff13871546c0, ffffff13a4c68880, 
    ffffff1386b704e3, ffffff1388caa3e8, 0, ffffff0000000000)
    fop_rename+0x68(ffffff13954cac80, ffffff13871546c0, ffffff13a4c68880, 
    ffffff1386b704e3, ffffff1388caa3e8, 0, ffffff0000000000)
    vn_renameat+0x3ff(0, 8047d72, 0, 80698b0, 0)
    renameat+0xdc(ffd19553, 8047d72, ffd19553, 80698b0)
    rename+0x22(8047d72, 80698b0)
    _sys_sysenter_post_swapgs+0x153()

The file is successfully renamed or moved on the fileserver, so the panic apparently happens after the RPC has been sent to the server.

The only non-standard thing I've done to the OS on this machine (that is, that's not part of the SmartOS standard config) is to re-enable deep c-states in /etc/system by commenting out "set idle_cpu_no_deep_c=1" (for a bit of power saving).