kern/38994: Kernel panic with 4.99.64 kernel on an iBook SE

["David H. Gutteridge" <dhgutteridge%sympatico.ca@localhost>]

>Number:         38994
>Category:       kern
>Synopsis:       Kernel panic with 4.99.64 kernel on an iBook SE
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 20 05:45:00 +0000 2008
>Originator:     David H. Gutteridge
>Release:        NetBSD 4.99.64
>Organization:
>Environment:


System: NetBSD 4.99.64 (GENERIC) #0: Sun Jun  1 07:36:51 PDT 2008
builds@wb30:/home/builds/ab/HEAD/macppc/200806010002Z-obj/home/builds/ab/HEAD/src/sys/arch/macppc/compile/GENERIC
Architecture: powerpc
Machine: macppc
>Description:
Hello,

Fairly recent GENERIC kernels panic on boot like so:

panic: sme_events_worker: invalid units for ENVSYS_FMONSTCHANGED
Stopped in pid 0.26 (system) at netbsd:cpu_Debugger+0x10: lwz r0, r1, 0x14
db> bt
0xd4c4ee10: at panic+0x21c
0xd4c4ee60: at sme_events_worker+0x230
0xd4c4ef10: at workqueue_worker+0xa0
0xd4c4ef40: at emptyidlespin+0x10
0xd4c4ef50: at 0xfffffffc

dmesg:

: invM-alid uniws for EM-^VSYS_FMM-oNSTCHANM-gED
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   2006, 2007, 2008
   The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
   The Regents of the University of California.  All rights reserved.

NetBSD 4.99.64 (GENERIC) #0: Sun Jun  1 07:36:51 PDT 2008

builds@wb30:/home/builds/ab/HEAD/macppc/200806010002Z-obj/home/builds/ab/HEAD/src/sys/arch/macppc/compile/GENERIC

total memory = 320 MB
avail memory = 299 MB
timecounter: Timecounters tick every 10.000 msec
found openpic PIC at 80040000
OpenPIC Version 1.2: Supports 4 CPUs and 64 interrupt sources.
bootpath: /pci@f2000000/mac-io@17/ata-4@1f000/disk@0:10,/netbsd
mainbus0 (root)
cpu0 at mainbus0: 750 (Revision 3.0), ID 0 (primary)
cpu0: HID0 8090c0a4<EMCP,DOZE,DPM,ICE,DCE,SGE,BTIC,BHT>, powersave: 1
cpu0: 366.67 MHz, no-parity 512KB WB L2 cache (PB SRAM) at 2.5:1 ratio
uni_n0 at mainbus0 address 0xf8000000
ki2c0 at uni_n0 address 0xf8001000
iic0 at ki2c0: I2C bus
uninorth0 at mainbus0
pci0 at uninorth0 bus 0
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 11 function 0
pchb0: Apple Computer UniNorth AGP Interface (rev. 0x00)
genfb0 at pci0 dev 16 function 0: ATI Technologies Rage L Mobility
genfb0: framebuffer at 0x91000000, size 800x600, depth 8, stride 800
wsdisplay0 at genfb0 kbdmux 1: console (default, vt100 emulation)
wsmux1: connecting to wsdisplay0
drm at genfb0 not configured
uninorth1 at mainbus0
pci1 at uninorth1 bus 0
pci1: i/o space, memory space enabled
pchb1 at pci1 dev 11 function 0
pchb1: Apple Computer UniNorth Host-PCI Bridge (rev. 0x00)
obio0 at pci1 dev 23 function 0: addr 0x80000000
obio0: enabling KeyLargo internal modem
i2s at obio0 offset 0x10000 not configured
zsc0 at obio0: irq 22,50
zstty0 at zsc0 channel 0
zstty1 at zsc0 channel 1
pmu0 at obio0 offset 0x16000 irq 47:  rev. 12
pmu0: initializing RTC
pmu0: initializing ADB
nadb0 at pmu0: Apple Desktop Bus
pmu0: power-mgt not configured
ki2c1 at obio0
iic1 at ki2c1: I2C bus
wdc0 at obio0 offset 0x1f000 irq 19, level triggered: DMA transfer
atabus0 at wdc0 channel 0
wdc1 at obio0 offset 0x20000 irq 20, level triggered: DMA transfer
atabus1 at wdc1 channel 0
wdc2 at obio0 offset 0x21000 irq 21, level triggered: DMA transfer
atabus2 at wdc2 channel 0
ohci0 at pci1 dev 24 function 0: Apple Computer KeyLargo USB Controller 
(rev. 0x00)
ohci0: interrupting at irq 27
ohci0: OHCI version 1.0
usb0 at ohci0: USB revision 1.0
ohci1 at pci1 dev 25 function 0: Apple Computer KeyLargo USB Controller 
(rev. 0x00)
ohci1: can't map mem space
uninorth2 at mainbus0
pci2 at uninorth2 bus 0
pci2: i/o space, memory space enabled
pchb2 at pci2 dev 11 function 0
pchb2: Apple Computer UniNorth Host-PCI Bridge (rev. 0x00)
gem0 at pci2 dev 15 function 0: Apple Computer GMAC Ethernet (rev. 0x00)
gem0: interrupting at irq 41
bmtphy0 at gem0 phy 0: BCM5201 10/100 media interface, rev. 2
bmtphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
gem0: Ethernet address 00:30:65:6b:e3:f2, 10KB RX fifo, 9KB TX fifo
biomask 80001fe netmask 80001fe ttymask 80001fe
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "mftb" frequency 16644884 Hz quality 100
uhub0 at usb0: Apple Computer OHCI root hub, class 9/0, rev 1.00/1.00, addr 
1
uhub0: 2 ports with 2 removable, self powered
adbkbd0 at nadb0 addr 2: PowerBook G3 keyboard
wskbd0 at adbkbd0: console keyboard, using wsdisplay0
wsmouse0 at adbkbd0 mux 0
adbms0 at nadb0 addr 3: EMP trackpad <tpad> 2-button, 400 dpi
wsmouse1 at adbms0 mux 0
adbbt0 at nadb0 addr 7: button device
wd0 at atabus0 drive 0: <TOSHIBA MK6014MAP>
wd0: drive supports 16-sector PIO transfers, LBA addressing
wd0: 5729 MB, 12416 cyl, 15 head, 63 sec, 512 bytes/sect x 11733120 sectors
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 4 (Ultra/66)
wd0(wdc0:0:0): using PIO mode 4, DMA mode 2, Ultra-DMA mode 4 (Ultra/66) 
(using DMA)
atapibus0 at atabus1: 2 targets
cd0 at atapibus0 drive 0: <MATSHITA CR-175, , 5AAE> cdrom removable
cd0: drive supports PIO mode 4, DMA mode 2
cd0(wdc1:0:0): using PIO mode 4, DMA mode 2 (using DMA)
Kernelized RAIDframe activated
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
WARNING: preposterous TOD clock time
WARNING: using filesystem time
WARNING: CHECK AND RESET THE DATE!
panic: sme_events_worker: invalid units for ENVSYS_FMONSTCHANGED
syncing disks... done
rebooting

I built a kernel with some debugging enabled/added for envsys (and I
commented out the panic() call so I could actually save a dmesg), as
below.

It looks like the CPU is getting picked up in the sensor framework.
The final messages are from the envsys_data record that's actually
triggering the panic, the device string "M-@" (probably just
gibberish?) isn't too helpful.  I haven't delved too deeply into the
code, but I infer the final messages are related to the cpu0 device,
given it's the only device that gets referenced and the sensor numbers
are quite similar.

macallan@ subsequently noted that this version of the G3 processor has
a built-in sensor.

I found an interesting blog entry about Mac temperature sensors here:
http://209.85.215.104/search?q=cache:ar-5TTEIIi8J:tech.kateva.org/2004/09/ibook-temperature-monitor-and-g3.html+G3+processor+sensor&hl=en&ct=clnk&cd=1&gl=ca

Debugging dmesg:

Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   2006, 2007, 2008
   The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
   The Regents of the University of California.  All rights reserved.

NetBSD 4.99.64 (GENERIC) #1: Thu Jun  5 23:54:09 EDT 2008

disciple@arcusvi:/Volumes/NetBSD-current_Tracking/usr/src/sys/arch/macppc/compile/obj/GENERIC

total memory = 320 MB
avail memory = 299 MB
timecounter: Timecounters tick every 10.000 msec
found openpic PIC at 80040000
OpenPIC Version 1.2: Supports 4 CPUs and 64 interrupt sources.
bootpath: /pci@f2000000/mac-io@17/ata-4@1f000/disk@0:10,/netbsd
mainbus0 (root)
cpu0 at mainbus0: 750 (Revision 3.0), ID 0 (primary)
cpu0: HID0 8090c0a4<EMCP,DOZE,DPM,ICE,DCE,SGE,BTIC,BHT>, powersave: 1
cpu0: 366.67 MHz, no-parity 512KB WB L2 cache (PB SRAM) at 2.5:1 ratio
uni_n0 at mainbus0 address 0xf8000000
ki2c0 at uni_n0 address 0xf8001000
iic0 at ki2c0: I2C bus
uninorth0 at mainbus0
pci0 at uninorth0 bus 0
pci0: i/o space, memory space enabled
pchb0 at pci0 dev 11 function 0
pchb0: Apple Computer UniNorth AGP Interface (rev. 0x00)
genfb0 at pci0 dev 16 function 0: ATI Technologies Rage L Mobility
genfb0: framebuffer at 0x91000000, size 800x600, depth 8, stride 800
wsdisplay0 at genfb0 kbdmux 1: console (default, vt100 emulation)
wsmux1: connecting to wsdisplay0
drm at genfb0 not configured
uninorth1 at mainbus0
pci1 at uninorth1 bus 0
pci1: i/o space, memory space enabled
pchb1 at pci1 dev 11 function 0
pchb1: Apple Computer UniNorth Host-PCI Bridge (rev. 0x00)
obio0 at pci1 dev 23 function 0: addr 0x80000000
obio0: enabling KeyLargo internal modem
i2s at obio0 offset 0x10000 not configured
zsc0 at obio0: irq 22,50
zstty0 at zsc0 channel 0
zstty1 at zsc0 channel 1
pmu0 at obio0 offset 0x16000 irq 47:  rev. 12
pmu0: initializing RTC
pmu0: initializing ADB
nadb0 at pmu0: Apple Desktop Bus
pmu0: power-mgt not configured
ki2c1 at obio0
iic1 at ki2c1: I2C bus
wdc0 at obio0 offset 0x1f000 irq 19, level triggered: DMA transfer
atabus0 at wdc0 channel 0
wdc1 at obio0 offset 0x20000 irq 20, level triggered: DMA transfer
atabus1 at wdc1 channel 0
wdc2 at obio0 offset 0x21000 irq 21, level triggered: DMA transfer
atabus2 at wdc2 channel 0
ohci0 at pci1 dev 24 function 0: Apple Computer KeyLargo USB Controller 
(rev. 0x00)
ohci0: interrupting at irq 27
ohci0: OHCI version 1.0
usb0 at ohci0: USB revision 1.0
ohci1 at pci1 dev 25 function 0: Apple Computer KeyLargo USB Controller 
(rev. 0x00)
ohci1: can't map mem space
uninorth2 at mainbus0
pci2 at uninorth2 bus 0
pci2: i/o space, memory space enabled
pchb2 at pci2 dev 11 function 0
pchb2: Apple Computer UniNorth Host-PCI Bridge (rev. 0x00)
gem0 at pci2 dev 15 function 0: Apple Computer GMAC Ethernet (rev. 0x00)
gem0: interrupting at irq 41
bmtphy0 at gem0 phy 0: BCM5201 10/100 media interface, rev. 2
bmtphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
gem0: Ethernet address 00:30:65:6b:e3:f2, 10KB RX fifo, 9KB TX fifo
biomask 80001fe netmask 80001fe ttymask 80001fe
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "mftb" frequency 16644884 Hz quality 100
sme_event_register: (cpu0) event registered (sensor= snum=8907424 type=110 
critval=0)
sme_events_init: events framework initialized for 'cpu0'
sme_event_register: (cpu0) event registered (sensor= snum=8907424 type=190 
critval=0) uhub0 at usb0: Apple Computer OHCI root hub, class 9/0, rev 
1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
adbkbd0 at nadb0 addr 2: PowerBook G3 keyboard
wskbd0 at adbkbd0: console keyboard, using wsdisplay0
wsmouse0 at adbkbd0 mux 0
adbms0 at nadb0 addr 3: EMP trackpad <tpad> 2-button, 400 dpi
wsmouse1 at adbms0 mux 0
adbbt0 at nadb0 addr 7: button device
wd0 at atabus0 drive 0: <TOSHIBA MK6014MAP>
wd0: drive supports 16-sector PIO transfers, LBA addressing
wd0: 5729 MB, 12416 cyl, 15 head, 63 sec, 512 bytes/sect x 11733120 sectors
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 4 (Ultra/66)
wd0(wdc0:0:0): using PIO mode 4, DMA mode 2, Ultra-DMA mode 4 (Ultra/66) 
(using DMA)
atapibus0 at atabus1: 2 targets
cd0 at atapibus0 drive 0: <MATSHITA CR-175, , 5AAE> cdrom removable
cd0: drive supports PIO mode 4, DMA mode 2
cd0(wdc1:0:0): using PIO mode 4, DMA mode 2 (using DMA)
Kernelized RAIDframe activated
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
sysmon: sensor 8907440, units 2616160, state 0, flags 0, device M-@
sysmon: sensor 8907440, units 2616160, state 0, flags 0, device M-@


>How-To-Repeat:
As above.

>Fix:
None known.  A workaround is to compile with DIAGNOSTIC enabled, this
masks the problem.


>Unformatted: