SOCD report detected: (AP watchdog expired)

I have another thing to check: WiFi, I've recently switched from using only Wifi to using only Ethernet. My system has been utterly stable since.

Also, I was doing a constant ping this morning to see how stable my new VDSL connection is and I also had my iPhone connected to the computer and when I disconnected it I got the following ping results, with packets lost initially and finally arriving after 4 - 19 seconds (the rest of the morning ping was at 70ms with a stddev of 1ms)

Returned my M1 Mac mini yesterday (16GB, 1TB SSD). I had to put up a fuss to get Apple to take it back as I got it in April but have had many issues, received one replacement and didn't want a second replacement.

Issues:

• random reboots, SOCD
• rapid battery drain on magic keyboard and trackpad (1-2 days full to empty)
• USB devices go missing on each reboot, requiring the cable to be removed and replugged
• TimeMachine backup drive (connection Thunderbolt to Firewire with genuine Apple cables) randomly gets kicked offline and marked read-only, sometimes requiring it to be re-initialized.
• Occasional screen flicker that can take several powers off/on to remedy

Many, many hours on the phone with Apple truing to sort this out. I finally gave up.

I do not recommend the M1 Mac Mini at the present time.

Not going to claim this is a fix, or even the source, just a data point.

I had very similar symptoms with my 2019 MBP (Intel, naturally) after upgrading to macOS 11.x. Mine was also being triggered by using a USB-C peripheral, in my case a CalDigit TB3+ dock. No dock: no crash, dock: endless flaky behavior with drives and monitors that inevitably led to a crash. I do not recall the messages at the time, but it turned out to be a 32-bit kernel extension that had come along for the ride since 2002. Took me a few days to track down, but removing that extension fixed the issue, I have had zero crashes since.

I wonder how many out there being affected also are long-time customers who migrated from machine to machine using Migration Assistant, and have bits of cruft underneath that may be clogging up the works? And how many are first-time customers on fresh machines?

Best of luck, been there, it's maddening until it is resolved.

seems like all M1 models, regardless of peripherals connected, have experienced this issue.

i'm now on 11.5.2 (20G95).

on a hunch, i disabled System Integrity Protection (not recommended to leaved disabled) and haven't had a restart in about 2 weeks. no clue or data to support that SIP is related to the restarts. my mac mini cpu temps appear to be reasonable (29c idle to under 60c while under load)

dtrace is pretty neat, but would have to leave on and logging for some time , and i don't really have the time or motivation right now (or quite frankly the knowledge or skill) to further investigate.

for the people that do have the time knowledge and skill - we can already see the new m1 complexity under the hood

https://github.com/AsahiLinux/docs/wiki/Glossary

progress being made here is promising, and may provide further data to discover root cause.

many software updates since this issue has been reported, and still no fix.

you have to think that they would have reproduced this multiple times in the lab.

the fact that it hasn't been fixed yet with updates.... does skew my bias to this being a hardware type issue that is ultimately resolved with some sort of replacement/exchange program..... when we have enough evidence to support this theory

also, aside from already disabling SIP to use dtrace

csrutil disable

i might also try

bputil -nkcas

on the office chance that this restart/panic is related to Secure Enclave Processor functions.

and may give more dtrace output

 -c, --disable-kernel-ctrr
This disables the enforcement of the "Configurable Text Read-only Region" (CTRR) hardware register that marks kernel memory as non-writable. This is
 sometimes required for performing actions such as using dynamic DTrace code hooks to profile kernel behavior or perform 3rd party kernel extension
 debugging.

since the 11.5.2 Update i have it now too... sudden crash while working in finalcutx greenscreen and crashing .... some hours before i had strange green flashing inside a finalcutx video so i had to create the video complete new !!! This is not acceptable ! i buy this new Mac M1 with pro video software. Now not even half a year old it suddenly crashes and my work on videos are garbage ! Yes i im a video producer and time is money. whatever happend between patch 11.5.1 and 11.5.2 (all my hdd where blinking extreme while this patches) what ever you did on the filesystem... redo it now!

i did not change anything on my external hdd before 11.5.1 everything work fine... 11.5.1 gave me this strange green flashing inside videos with 11.5.2 the macmini crash greenscreen complete

d3cbgf wrote:

sorry mean't to link this diagram instead from https://support.apple.com/en-ca/guide/security/sec59b0b31ff/web

https://discussions.apple.com/content/attachment/c0d9c77d-6920-4c59-a53e-b45d581c1735

other possible meaning for D in SOCD

-direct memory access (DMA)

-DRAM

i can't see any use further troubleshooting this. it's a black box that can only be fixed by vendor.

my guess is it's a real doozy of a bug too.

Nice link explaining some basics.

You are right, it seems like a software bug in neither in the Application Processor Boot ROM running on the application processor (AP) or the sepOS running on Secure Enclave Processor. And since all is encrypted further troubleshooting seems foolish and only the vendor can fix this!

But there is not fix since months... maybe they are too busy creating fancy new slides for next Keynote?

@Mini-M1 ~ % uptime

17:23 up 17 days, 15:07, 2 users, load averages: 3.00 1.69 1.34

BigSur 11.5.2

Mem: 16GB

SSD: 1TB

Before 11.5.2 I had a few of these crashes but after the update and turning off all intel background processes, I haven't had a crash since.

I connect to a Viewsonic VP3881 39" Ultrawide screen over HDMI and I have an Orico 3.1 Hub that is connected to my SD reader. I also have two Display Link Adapters and a Lightning connection where I can connect all four displays at the same time with no problem.

If you just bought a new unit and haven't installed anything and it's pulling these errors, then I'd say they are definitely hardware defective, and based on the number of people with this problem, it's probably bigger than Apple admits. People might want to look into a class action/recall to fix this problem since Mac Book Air users don't have this issue it seems.

My M1 iMac crashed for the first time tonight (had it for about 6 weeks). Error message: SOCD report detected: (AP watchdog expired). It rebooted itself. I lost a lot of the document I was working on, but everything else seems okay.

I read the replies here. "External hard drives" seem to be a theme. I'm connected to a new LaCie drive for Time Machine (I bought it at my local Apple store at their recommendation). I'm going to disconnect the drive for awhile and see what happens.

Is there any more information from Apple to let us know how serious the issue is and what it might portend?

For USB2, M1 uses something called eUSB2.

Since M1 is on a 5nm process, there are "quantum effects" that can impact 3.3 V ( which USB2 uses).

"M1 Macs can only support 4 chained USB2 (HS) hubs, or *2* chained USB1 (FS/LS) hubs, due to timing limitations introduced by the eUSB repeater. Normal hosts support up to 5 daisy chained hubs in either case."

"could easily see myself ending up with a 5-hub chain in some use cases (USB3 hub -> USB2 hub that has two internal tiers -> USB2 hub off to the side -> device with internal hub). Worse if the USB3 hub is multi-tier too."

the whole thread is here: ***

I think Hector might be investigating a different issue, but it's interesting none the less, especially with all those mentioning USB devices possibly being related to this issue.

[Link Edited by Moderator]

have not had one instance SOCD after running these commands in a Recovery Mode terminal instance

Disable SIP

csrutil disable

Disable other security settings for Apple Silicon Macs

bputil -nkcas

-n, --permissive-security

              Selecting this option will make your system easier to compromise!

              This changes the security mode to Permissive Security. Permissive Security uses the same "global" digital signature for
              macOS as the above Reduced Security option, in order to allow running software which is not the latest version. Thus any-
              thing other than the latest software therefore may have security vulnerabilities. At a high level, Permissive Security
              allows configuration options to be set to not require all software to be digitally signed. This can allow users who are not
              part of the Apple Developer program to still be able to introduce their own software into their system. Additionally, espe-
              cially dangerous security downgrades may be restricted to Permissive Security, and only available via CLI tools for power
              users rather than GUIs. Passing this option will explicitly recreate the LocalPolicy from scratch, (i.e. it does not pre-
              serve any existing security policy options) and only the options specified via this tool will exist in the output local
              policy.

-k, --enable-kexts.

              Because this option automatically downgrades to Reduced Security mode if not already true, selecting this option will make
              your system easier to compromise!

              The AuxilaryKernelCache is a SEP-signed boot object which can be verified and loaded into kernel memory before that memory
              is restricted to being non-writable by a "Configurable Text Read-only Region" (CTRR) hardware register. Introducing 3rd
              party kernel extensions can introduce architectural or implementation flaws into the kernel, which can lead to system com-
              promise. In order to achieve iOS-like security properties, 3rd party kexts must be denied by default, and only loadable if
              the customer consciously opts in to lowering their security from 1TR.

-c, --disable-kernel-ctrr

              Because this option automatically downgrades to Reduced Security mode if not already true, selecting this option will make
              your system easier to compromise!

              This disables the enforcement of the "Configurable Text Read-only Region" (CTRR) hardware register that marks kernel memory
              as non-writable. This is sometimes required for performing actions such as using dynamic DTrace code hooks to profile ker-
              nel behavior or perform 3rd party kernel extension debugging. However, the lack of CTRR enforcement makes it much easier
              for an attacker to modify the kernel with exploits.

-a, --disable-boot-args-restriction

              Because this option automatically downgrades to Reduced Security mode if not already true, selecting this option will make
              your system easier to compromise!

              The macOS kernel accepts a variety of configuration options via an nvram variable named "boot-args". However, some of these
              options direct the kernel to reduce some security enforcement. In order to achieve iOS-like security properties, this secu-
              rity-downgrading behavior needs to be denied by default, and only available if the customer consciously opts in to lowering
              their security from 1TR.


 -s, --disable-ssv

              Because this option automatically downgrades to Permissive Security mode if not already true, selecting this option will
              make your system easier to compromise!

              The Signed System Volume is a mechanism to digitally sign and verify all data from the System volume (where the primary
              macOS software is stored). The result is that malware cannot directly manipulate executables there in order to achieve per-
              sistent execution, or manipulate the data stored there in order to try to exploit programs. This option disables Signed
              System Volume integrity enforcement, to allow customers to modify the System volume. SSV cannot be disabled while FileVault
              is enabled. Customer modifications to the System volume are not expected to persist across software updates.

Okay, it has been a week without receiving the dreaded message and enduring an involuntary restart. From what I am reading, there is little we can do to predict the expiration of AP's watchdog. In all seriousness, I hope that Apple is actively working on this issue. I did go to Apple Support with my data. They said they would get back to me. Still waiting...

Have been using my iMac for several months now, but had my first event today. External devices: 2 Epson scanners, one of which stays on and is used frequently, External HDs SanDisk Extreme portable SSD 1 TB (SDSSDE60-1TOO) & ADATA (HD830-4T - from PC so read-only). Recently I was unable to reformat the ADATA HD so just removed it and donated to my husband to use with his PC. I added a SanDisk 4TB (SDSSDE61-1TOO). I was in the process of downloading iCloud Drive files directly to the new HD when the crash occured.

I really don’t think it’s a power supply issue. If it was, it would reboot and you would get a error message like “your Mac wasn’t properly shut down…”

Me pasó y realmente tenía una unidad extern conectada