Recurring kernel panic

Question

Level 1

0 points

Recurring kernel panic

Hi there. I'm getting kernel panics every few days and can't find what the problem is. Was wondering if anyone could give me some ideas? Situation is as follows:

About a month ago my internal hard drive on the PB refused to mount and it still won't (don't have time to sort that issue now) so I am now booting from a LaCie d2 Big Disk 320GB over Firewire 400.

This was a completely new install of Tiger from an original DVD on the LaCie disk but it did have other data on it (stuff already on there and now stuff I've rescued from the internal HD). I've never booted from this disk in the past but it has worked faultlessly for over a year.

About a week after installing Tiger on it I got a kernel panic which I've never had in the three years I've had this laptop. Since then, they've been recurring every 3/4 days. The latest panic log is here:

Thu Nov 24 18:08:38 2005
panic(cpu 0 caller 0x000E3FBC): vnode_writedone: numoutput < 0
Latest stack backtrace for cpu 0:
Backtrace:
0x00095698 0x00095BB0 0x0002683C 0x000E3FBC 0x000D8C60 0x004EA230 0x004DCFF4 0x0072F158
0x00732CCC 0x00732DCC 0x00529FDC 0x0052A1FC 0x0063FFF4 0x00640400 0x0062BC6C 0x0062B6EC
0x0060DA44 0x005EF040 0x005EE940 0x006B9A24 0x006A9450 0x002CF960 0x002CE828 0x000A9814
Kernel loadable modules in backtrace (with dependencies):
com.apple.iokit.IOFireWireSerialBusProtocolTransport(1.4.0)@0x63e000
dependency: com.apple.iokit.IOFireWireSBP2(1.7.5)@0x628000
dependency: com.apple.iokit.IOSCSIArchitectureModelFamily(1.4.4)@0x522000
dependency: com.apple.iokit.IOFireWireFamily(2.0.8)@0x5e5000
com.apple.iokit.IOFireWireSBP2(1.7.5)@0x628000
dependency: com.apple.iokit.IOFireWireFamily(2.0.8)@0x5e5000
com.apple.iokit.IOSCSIBlockCommandsDevice(1.4.4)@0x72d000
dependency: com.apple.iokit.IOSCSIArchitectureModelFamily(1.4.4)@0x522000
dependency: com.apple.iokit.IOStorageFamily(1.4)@0x4d7000
com.apple.iokit.IOStorageFamily(1.4)@0x4d7000
com.apple.iokit.IOSCSIArchitectureModelFamily(1.4.4)@0x522000
com.apple.driver.AppleFWOHCI(2.5.2)@0x6a3000
dependency: com.apple.iokit.IOPCIFamily(1.7)@0x458000
dependency: com.apple.iokit.IOFireWireFamily(2.0.8)@0x5e5000
com.apple.iokit.IOFireWireFamily(2.0.8)@0x5e5000
Proceeding back via exception chain:
Exception state (sv=0x1CDDE280)
PC=0x00000000; MSR=0x0000D030; DAR=0x00000000; DSISR=0x00000000; LR=0x00000000; R1=0x00000000; XCP=0x00000000 (Unknown)

Kernel version:
Darwin Kernel Version 8.3.0: Mon Oct 3 20:04:04 PDT 2005; root:xnu-792.6.22.obj~2/RELEASE_PPC
*******

All of the previous logs have identical first line "panic(cpu..." and the rest is virtually identical (some numbers seem to have changed).

Also, after I've restarted when I get the kernel panic, as soon as I log in I get a message saying "Disk Insertion: The disk you inserted was not readable by this computer." and it gives me options of Initialize... Ignore or Eject. I have been clicking Ignore but this last time I did nothing and the message went away after about a minute. The only disk I have is the external boot disk which it obviously can read! There's nothing in the CD drive, or a USB port, and the internal HD is unmounted. Not sure if that's relevant...

I'm no good at interpreting logs so if anyone can shed some light that would be great. Having looked around, I've tried some things such as repairing permissions and that hasn't helped. The log seems to focus on firewire things so I've tried updating firmware for the LaCie drive but because it's my boot drive it won't let me do it. And it has worked fine for over a year and the latest firmware update available is from over six months ago so I don't think that's the problem.

Also suggested seem to be RAM issues but the only RAM I have in the machine is the original 512 that it came with. Don't have any peripherals apart from the boot drive. The only software I have is standard Apple stuff and MS Office and a few other apps all of which I've used for years. I don't use the machine heavily so there's plenty of memory available. Heat has also been mentioned but it's reasonably cool and now that I don't use the internal HD the fan is a lot less active and it never gets as hot as it did.

It's kernel panicked when I've been using MS Word, Safari, or just watching Real One Player streamed videos.

I'm rather at a loss for what's going on... if anyone could enlighten me (especially as to deciphering the log if that holds any clues) then that would be great.

Many thanks for your time reading this... apologies it's rather long! Ian.

PowerBook Titanium G4 800, 512MB Mac OS X (10.4.3)

Posted on Nov 24, 2005 11:53 AM

Reply

Answer 1

Best reply

Dean Pahl

Level 4

3,870 points

Nov 25, 2005 1:03 AM in response to Ian Caddy

Hi, Ian —

Please accept a warm welcome to Apple Discussions!

I'm no expert — this is partly research, partly conjecture (I hope ~reasonable), so please take it as such.

Looking through the kernel loadable modules in the backtrace ( IOFireWireSerialBus
ProtocolTransport through IOFireWireFamily), it certainly seems as if there's a FireWire problem. Is the LaCie drive the only FireWire device you have connected? (If not, disconnect everything else and try again. But I guess you have only a single FireWire port — so what the heck am I saying? Duh.) If it is — my guess is that either your FireWire port has a problem or the LaCie drive does; the latter, unfortunately, ~more likely. What kind, I don't know — but its result is clearly significant.

(Writing a negative hexadecimal seems to be what it's saying — but I'm really reticent to presume I understand that!)

Unfortunately, neither the documentation for vnode_writedone nor a few quick searches ( A, B; several others in specific Mac-user forums) seem to be a whole lot of help. Here are a free computer magazines thread and a MacNN thread you may find interesting — but inconclusive.

Given the importance of vnode.h (as the first link cited says, "The vnode is the focus of all file activity in UNIX. There is a unique vnode allocated for each active file, each current directory, each mounted-on file, text file, and the root") — my strong inclination, given your current lack of alternatives, is to suggest that you contact LaCie directly ( UK / US) as soon as feasible.

Fwiw, I hope this is helpful to you . . .

Good luck!
Dean

Reply

Answer 2

Ian Caddy Author

Level 1

0 points

Nov 25, 2005 10:15 AM in response to Ian Caddy

Hi Dean,

Thanks for your comments and the links. I've read through and as you say it seems to suggest the LaCie drive is the culprit, but it's inconclusive.

One of the major differences seems to be that my panics happy every three days as opposed to more often.

Having looked again at the logs, the last four panics have been almost-disturbingly regular in timing:

15/11 @ 2145
18/11 @ 1945
21/11 @ 2246
24/11 @ 1808

Don't know if that's a clue as to it being a system file issue which is accessed periodically?

Also, there were no problems at start-up and I sleep it numerous times every day (I never shutdown the Mac) and there doesn't seem to be any correlation with the kernel panics. The drive spins up and down perfectly happily - there seems to be little link between what I'm doing and when it crashes.

I've got in touch with LaCie and am awaiting a Tech response to see if they can shed any light on it.

Thanks for your help and I'll keep you posted on developments. Any further suggestions from anyone would be much appreciated.

Ian.

Reply

Answer 3

Dean Pahl

Level 4

3,870 points

Nov 25, 2005 11:14 AM in response to Ian Caddy

Hi again, Ian —

A few additional thoughts for your consideration:

(1) The periodicity is puzzling. Since you "never shutdown the Mac," I can't think of a system activity that would occur every three days... Anything on your network configuration that might? or a maintenance utility you have set to auto-whatever?

(2) You haven't mentioned testing/repairing the LaCie's directory — whether using Disk Utility or a 3rd party utility like DiskWarrior or TechTool. I'd certainly consider this worth doing — periodicity be dam*ned!

(3) Btw, I'd normally expect that the " message saying 'Disk Insertion: The disk you inserted was not readable by this computer'" would be an indication of problems mounting the LaCie. Have you considered responding to this differently than "clicking Ignore" or "[doing] nothing and the message went away after about a minute"?
Such as shutting-down — and perhaps disconnecting both Mac and LaCie from power for a few minutes — then restarting?
(4) Also — though it may seem a tad mystical — how about resetting the PMU? This would seem for the most part unconnected — but because the PMU "is responsible for... some input/output as it relates to the computer sleeping," I'd try it.
I'll be very interested to hear of your progress...
Good luck!
Dean

Reply

Answer 4

Ian Caddy Author

Level 1

0 points

Nov 30, 2005 12:51 PM in response to Dean Pahl

Hi Dean, sorry it's been a few days,

Thanks for your advice, it's been very helpful and isolated the problem I think.

Regular almost-as-clockwork I had another kernel panic on Sunday night (2711 @ 1705). The only non-system thing I could think of which would run periodically would be Sophos Anti-Virus. Also, looking back through the installation log, that was the last thing I'd installed before this all started so, somewhat optimistically, I uninstalled it. Sadly though that hasn't worked and I've just had another panic (3011 @ 1942) still in the same time pattern... It's annoying to have to wait three days to see if anything's had an effect! That said, I am very grateful it doesn't happen every few hours!

I've also tried clicking 'eject' and 'initialize' after the panics - nothing happens for the former, and the second opens Disk Utility.

You also said to verify the disk. I thought I'd done this but I hadn't, I'd only verified permissions. Apologies for the oversight on my part as this seems to have flagged up a (hopefully 'the') problem as shown here (this was with DU):

Verifying volume “LaCie HD”
Checking HFS Plus volume.
Checking Extents Overflow file.
Checking Catalog file.
Checking multi-linked files.
Checking Catalog hierarchy.
%)
Checking Extended Attributes file.
Checking volume bitmap.
Volume Bit Map needs minor repair
Checking volume information.
Invalid volume free block count
Invalid volume free block count
%@ instead of %@)",2)
28422029
28422028
The volume LaCie HD needs to be repaired.

Error: The underlying task reported failure on exit

1 HFS volume checked
Volume needs repair

Hopefully then that's the cause of the problem. I'd like to back-up the disc before I repair it but, as seeing as I've already lost one hard drive, I don't have another back-up and thus will wait to do this until the weekend when I can use a friend's. What I'll do then is zero-write the disk and do a completely fresh install of Tiger. I'm guessing that this should solve whatever disk problem there is?

My only concern with doing this is the periodicity thing. There'll obviously be a lot I want to drag back on to my disk when it's newly installed - and am somewhat worried that one of these could be a factor in all this? They'll all just be AACs or PDFs or .docs or something fairly standard apart from a few .plist files and some of the app folders in home/library. I can't imagine any of those would be problematic - just thought I'd ask your advice. Indeed, now I know the disk problem I'll post that as a separate discussion topic. Will put the link in here later - should have written the other one first, doh!

Very many thanks for your help with this!

It's all been greatly appreciated,

Ian

Quick edit: being a newbie to the forums I hadn't realised this automatically goes to the top of the posts, so I've not re-posted the query re: the periodicity. Ta!

Also forgot to say, LaCie support say to check that the drive has the latest firmware. Because it's the boot drive it won't let me update the firmware so this is also something I can sort out when I wipe it.

Reply

Answer 5

Dean Pahl

Level 4

3,870 points

Nov 30, 2005 6:04 PM in response to Ian Caddy

Hello again, Ian —

Please pardon me at the outset if I come across like a tonne of C-4 bricks here...

(1) First of All Things: Get that Sophos Anti-Virus Garbage off of your PowerBook
immediately!
I think the probability is soaring that "SAV" is responsible for your troubles. (Or, at least, many of them.)
A quick search of Sophos' KnowledgeBase yielded instructions for finding their uninstaller in this article. Let's hope it works — by which I mean, that it searches-and-destroys every residual piece of its former existence. (See this unrelated but bizarre article about a Norton Anti-Virus residual — and that's but one of many...)
OK, Dean... take a d e e p, cleansing breath...
More on this in a moment.
(2) Imo, there's very little to worry about in allowing Disk Utility (DU) to go ahead and repair the errors it's detected — based on what you've posted — "Volume Bit Map needs minor repair" and "Invalid volume free block count." Please read this Apple KnowledgeBase article that explains these as "benign errors."
So you decide on when to do the repairs — after starting-up ("C-booting") from your Install Disc. A ~normal recommendation when using DU to repair your disk is to run "repair disk" again once or twice after DU reports the errors have been repaired. I've not done this myself — but I trust others who covey this advice.
Now back to item (1). I really mean this: you don't need it and it's almost certainly doing your PowerBook harm. (Not an unusual situation — thank ye, anti-virus software marketers!) I don't expect you to just take my word on this, however. So how about reading a few things:
• A very well-written MacFixIt forum post about Macs, viruses, and anti-virus
software
• This recent thread here in Apple DIscussions about Macs and malware, viruses,
etc. Or search the Discussions; there are many threads like this.
• Mac user ratings and comments in versiontracker and MacUpdate about Sophos Anti-Virus. These are, naturally, mixed (after all, these folks for some reason tried the software) — but I read 3 pages of 'em, to be fair. Note that several users report system problems caused by SAV; also that it's believed to primarily focus on the Win/Mac server and enterprise market.
That's my best effort at throttling an incipient diatribe. If my inclination is correct — then, hopefully, you don't have significant disk errors and removing SAV may cure the panics!
(3) Re: "I'd like to back-up the disc before I repair it but, as seeing as I've already lost one hard drive, I don't have another back-up and thus will wait to do this until the weekend when I can use a friend's. What I'll do then is zero-write the disk and do a completely fresh install of Tiger. I'm guessing that this should solve whatever disk problem there is? . . .There'll obviously be a lot I want to drag back on to my disk when it's newly installed - and am somewhat worried that one of these could be a factor in all this? They'll all just be AACs or PDFs or .docs or something fairly standard apart from a few .plist files and some of the app folders in home/library. I can't imagine any of those would be problematic - just thought I'd ask your advice."
Here are my thoughts on this, fwiw. I remember you said that you don't have time to resolve the problems with your internal HD at the moment, but... I suggest you make the time asap. Some of what you're asking may be answered by my suggestions above; I'll leave judging that up to you. As to stuff you want to "drag back on" — documents should be fine; otherwise (system-affecting stuff), yes, unresolved problems can reappear this way. I recommend careful, stepwise actions in that regard: limit what you copy back and do it liitle-by-little, allowing plenty of time for observation before adding "the next batch." This way, you may be able to isolate any issues. Best of all, fix or replace the internal HD — reformat and reinstall OS X 10.4.x the external, clone #1 while it's "clean," and use the external for its real purpose... Enough said?
Best wishes!
Dean

Reply