Can someone take a look at panic report for me? Machine rebooting often.

Question

Level 1

0 points

Can someone take a look at panic report for me? Machine rebooting often.

Hello,

A user has reported multiple unexpected restarts in the last few weeks. I made sure he is up to date and has 10.10.5 on his machine. I have examined the log files in /Library/Logs/DiagnosticReports, and seem to be seeing a common thread with the kernel panics. The backtrace always seems to be pointing to com.apple.iokit.* files. For the majority of the panics, and in the example I've provided below, it seems the last loaded and unloaded kexts are com.apple.driver.AppleUSBAudio and com.apple.driver.AppleHIDKeyboard.

I'm not skilled enough to glean what step I should take to resolve this issue. Would clearing out display preference files be a good place to start? Does the following report seem indicate it's the video card itself? Or one of the peripherals attached to it- the thunderbolt display? Does it look like it's software or hardware? These are just generalized questions, i don't expect each one to be answered. I can provide more of the panic reports, but this one is quite exemplary of what I'm seeing in all of them. I also noticed that with yesterdays panics, there were two gpuRestart logs two, indicating the gpu had hanged.

Any help or suggestions are greatly appreciated. If it's a bad video card, I'd like to know now before rebuilding the darned thing and going through all of this again.

Anonymous UUID: FAD0860B-CC1C-F62B-E611-AF27ABE7176F

Tue Aug 18 12:57:29 2015

*** Panic Report ***

panic(cpu 2 caller 0xffffff800a417cc2): Kernel trap at 0xffffff800a10e11b, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0xffffff81ad259000, CR3: 0x000000000d1ea000, CR4: 0x00000000001627e0

RAX: 0x0000000000000000, RBX: 0x000000000000045c, RCX: 0x0000000000000500, RDX: 0x00000000160b0000

RSP: 0xffffff80ec873c88, RBP: 0xffffff80ec873d00, RSI: 0x0000000000002800, RDI: 0xffffff81ad259000

R8: 0x00000000000000e3, R9: 0x0000000000000000, R10: 0x0000000007fc0d68, R11: 0x00000000f2b4ceca

R12: 0x0000000000000004, R13: 0xffffff80dbf77000, R14: 0x0000000000000002, R15: 0xffffff81ad259000

RFL: 0x0000000000010206, RIP: 0xffffff800a10e11b, CS: 0x0000000000000008, SS: 0x0000000000000000

Fault CR2: 0xffffff81ad259000, Error code: 0x0000000000000002, Fault CPU: 0x2

Backtrace (CPU 2), Frame : Return Address

0xffffff80ec873930 : 0xffffff800a32bda1

0xffffff80ec8739b0 : 0xffffff800a417cc2

0xffffff80ec873b70 : 0xffffff800a434b73

0xffffff80ec873b90 : 0xffffff800a10e11b

0xffffff80ec873d00 : 0xffffff7f8b499f65

0xffffff80ec873d30 : 0xffffff7f8c4fbd9e

0xffffff80ec873e20 : 0xffffff7f8b49b5b0

0xffffff80ec873e60 : 0xffffff7f8b49a80e

0xffffff80ec873e90 : 0xffffff7f8b496967

0xffffff80ec873ef0 : 0xffffff800a8d617d

0xffffff80ec873f40 : 0xffffff800a8d3fed

0xffffff80ec873f80 : 0xffffff800a8d40e6

0xffffff80ec873fb0 : 0xffffff800a4125b7

Kernel Extensions in backtrace:

com.apple.iokit.IOGraphicsFamily(2.4.1)[6F7F093D-DBEA-356A-9A08-D8EAC7F767DE]@0 xffffff7f8b48b000->0xffffff7f8b4c5fff

dependency: com.apple.iokit.IOPCIFamily(2.9)[D8F585E8-2EE9-3135-8E37-A034123FE45C]@0xffffff 7f8ab24000

com.apple.driver.AppleIntelFramebufferAzul(10.0.6)[02479236-D51D-3B11-9EE8-5876 0AEFDF5F]@0xffffff7f8c4f6000->0xffffff7f8c540fff

dependency: com.apple.iokit.IOPCIFamily(2.9)[D8F585E8-2EE9-3135-8E37-A034123FE45C]@0xffffff 7f8ab24000

dependency: com.apple.iokit.IOACPIFamily(1.4)[70E2B65E-A91A-3522-A1A0-79FD63EABB4C]@0xfffff f7f8b399000

dependency: com.apple.iokit.IOAcceleratorFamily2(156.16)[8DA5CE1F-2C00-3CE3-8BF1-1FC07BFCF4 E7]@0xffffff7f8c3e8000

dependency: com.apple.iokit.IOReportFamily(31)[781C9DD1-4CE9-3AEB-85EA-D420CEC18916]@0xffff ff7f8b392000

dependency: com.apple.AppleGraphicsDeviceControl(3.10.24)[B2B5765C-4EC5-3C51-85D9-91B90D38D 485]@0xffffff7f8c4ef000

dependency: com.apple.iokit.IOGraphicsFamily(2.4.1)[6F7F093D-DBEA-356A-9A08-D8EAC7F767DE]@0 xffffff7f8b48b000

BSD process name corresponding to current thread: kernel_task

Mac OS version:

14E46

Kernel version:

Darwin Kernel Version 14.4.0: Thu May 28 11:35:04 PDT 2015; root:xnu-2782.30.5~1/RELEASE_X86_64

Kernel UUID: E3C26B2F-8B97-3F1D-B193-690F7E34F830

Kernel slide: 0x000000000a000000

Kernel text base: 0xffffff800a200000

__HIB text base: 0xffffff800a100000

System model name: MacBookPro11,1 (Mac-189A3D4F975D5FFC)

System uptime in nanoseconds: 126289958324934

last loaded kext at 122320630374491: com.apple.driver.AppleUSBAudio 295.23 (addr 0xffffff7f8cc39000, size 315392)

last unloaded kext at 122476707288613: com.apple.driver.AppleHIDKeyboard 176.2 (addr 0xffffff7f8cb2e000, size 24576)

loaded kexts:

com.McAfee.kext.AppProtection 1.1.0d1

com.McAfee.AVKext 1

com.apple.driver.AppleUSBDisplays 372.1

com.apple.iokit.AppleBCM5701Ethernet 10.1.3

com.apple.driver.AppleFWOHCI 5.5.2

com.apple.driver.AppleUSBEthernet 2.4.13

com.apple.filesystems.smbfs 3.0.1

com.apple.filesystems.autofs 3.0

com.apple.iokit.IOBluetoothSerialManager 4.3.5f8

com.apple.driver.AGPM 110.19.6

com.apple.driver.ApplePlatformEnabler 2.2.0d4

com.apple.driver.X86PlatformShim 1.0.0

com.apple.driver.AppleOSXWatchdog 1

com.apple.driver.AppleUpstreamUserClient 3.6.1

com.apple.driver.AppleHDA 272.18.1

com.apple.iokit.IOUserEthernet 1.0.1

com.apple.driver.AppleCameraInterface 5.36.0

com.apple.Dont_Steal_Mac_OS_X 7.0.0

com.apple.driver.AppleHWAccess 1

com.apple.driver.AppleHV 1

com.apple.driver.AppleLPC 1.7.3

com.apple.driver.AppleSMCLMU 2.0.7d0

com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 4.3.5f8

com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0

com.apple.driver.AppleBacklight 170.7.4

com.apple.driver.AppleThunderboltIP 2.0.2

com.apple.driver.AppleMCCSControl 1.2.12

com.apple.driver.AppleIntelHD5000Graphics 10.0.6

com.apple.driver.AppleIntelFramebufferAzul 10.0.6

com.apple.driver.AudioAUUC 1.70

com.apple.driver.AppleUSBTCButtons 240.2

com.apple.driver.AppleUSBTCKeyboard 240.2

com.apple.driver.AppleUSBCardReader 3.5.5

com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1

com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0

com.apple.BootCache 36

com.apple.driver.XsanFilter 404

com.apple.iokit.IOAHCIBlockStorage 2.7.1

com.apple.driver.AppleAHCIPort 3.1.2

com.apple.driver.AppleUSBHub 705.4.2

com.apple.driver.AppleUSBEHCI 705.4.14

com.apple.driver.AirPort.Brcm4360 930.37.3

com.apple.driver.AppleUSBXHCI 710.4.11

com.apple.driver.AppleSmartBatteryManager 161.0.0

com.apple.driver.AppleRTC 2.0

com.apple.driver.AppleHPET 1.8

com.apple.driver.AppleACPIButtons 3.1

com.apple.driver.AppleSMBIOS 2.1

com.apple.driver.AppleACPIEC 3.1

com.apple.driver.AppleAPIC 1.7

com.apple.nke.applicationfirewall 161

com.apple.security.quarantine 3

com.apple.security.TMSafetyNet 8

com.apple.driver.AppleUSBAudio 295.23

com.apple.iokit.IOUSBHIDDriverPM 710.4.7

com.apple.iokit.IOFireWireIP 2.2.6

com.apple.iokit.IOEthernetAVBController 1.0.3b3

com.apple.iokit.IOFireWireFamily 4.5.7

com.apple.driver.AppleThunderboltPCIUpAdapter 2.0.2

com.apple.driver.AppleThunderboltDPOutAdapter 4.0.6

com.apple.kext.triggers 1.0

com.apple.driver.DspFuncLib 272.18.1

com.apple.kext.OSvKernDSPLib 1.15

com.apple.driver.X86PlatformPlugin 1.0.0

com.apple.driver.IOPlatformPluginFamily 5.9.1d7

com.apple.iokit.IOBluetoothHostControllerUSBTransport 4.3.5f8

com.apple.iokit.IOBluetoothFamily 4.3.5f8

com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0

com.apple.driver.AppleBacklightExpert 1.1.0

com.apple.driver.AppleSMC 3.1.9

com.apple.iokit.IOUSBUserClient 705.4.0

com.apple.driver.AppleSMBusController 1.0.13d1

com.apple.iokit.IOSurface 97.4

com.apple.driver.AppleHDAController 272.18.1

com.apple.iokit.IOHDAFamily 272.18.1

com.apple.iokit.IOSerialFamily 11

com.apple.iokit.IONDRVSupport 2.4.1

com.apple.AppleGraphicsDeviceControl 3.10.24

com.apple.iokit.IOAcceleratorFamily2 156.16

com.apple.iokit.IOGraphicsFamily 2.4.1

com.apple.driver.AppleUSBMultitouch 245.2

com.apple.iokit.IOSCSIBlockCommandsDevice 3.7.5

com.apple.iokit.IOUSBMassStorageClass 3.7.2

com.apple.iokit.IOSCSIArchitectureModelFamily 3.7.5

com.apple.iokit.IOAudioFamily 203.3

com.apple.vecLib.kext 1.2.0

com.apple.iokit.IOUSBHIDDriver 705.4.0

com.apple.driver.AppleThunderboltDPInAdapter 4.0.6

com.apple.driver.AppleThunderboltDPAdapterFamily 4.0.6

com.apple.driver.AppleThunderboltPCIDownAdapter 2.0.2

com.apple.driver.AppleUSBMergeNub 705.4.0

com.apple.driver.AppleUSBComposite 705.4.9

com.apple.driver.CoreStorage 471.30.1

com.apple.iokit.IOAHCIFamily 2.7.5

com.apple.driver.AppleThunderboltNHI 3.1.7

com.apple.iokit.IOThunderboltFamily 4.2.2

com.apple.iokit.IO80211Family 730.60

com.apple.driver.mDNSOffloadUserClient 1.0.1b8

com.apple.iokit.IONetworkingFamily 3.2

com.apple.iokit.IOUSBFamily 720.4.4

com.apple.driver.AppleEFINVRAM 2.0

com.apple.driver.AppleEFIRuntime 2.0

com.apple.iokit.IOHIDFamily 2.0.0

com.apple.iokit.IOSMBusFamily 1.1

com.apple.security.sandbox 300.0

com.apple.kext.AppleMatch 1.0.0d1

com.apple.driver.AppleKeyStore 2

com.apple.driver.AppleMobileFileIntegrity 1.0.5

com.apple.driver.AppleCredentialManager 1.0

com.apple.driver.DiskImages 397

com.apple.iokit.IOStorageFamily 2.0

com.apple.iokit.IOReportFamily 31

com.apple.driver.AppleFDEKeyStore 28.30

com.apple.driver.AppleACPIPlatform 3.1

com.apple.iokit.IOPCIFamily 2.9

com.apple.iokit.IOACPIFamily 1.4

com.apple.kec.Libm 1

com.apple.kec.pthread 1

com.apple.kec.corecrypto 1.0

System Profile:

Graphics: Intel Iris, Intel Iris, Built-In

AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x112), Broadcom BCM43xx 1.0 (7.15.166.24.3)

Bluetooth: Version 4.3.5f8 15969, 3 services, 27 devices, 1 incoming serial ports

PCI Card: pci11c1,5901, IEEE 1394 Open HCI, Thunderbolt@190,0,0

PCI Card: Apple 57761-B0, Ethernet Controller, Thunderbolt@191,0,0

PCI Card: pci12d8,400e, USB Open Host Controller, Thunderbolt@196,0,0

PCI Card: pci12d8,400e, USB Open Host Controller, Thunderbolt@196,0,1

PCI Card: pci12d8,400f, USB Enhanced Host Controller, Thunderbolt@196,0,2

Thunderbolt Bus: MacBook Pro, Apple Inc., 17.2

Thunderbolt Device: Thunderbolt Display, Apple Inc., 1, 26.2

Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343531533641465238412D50422020

Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1600 MHz, 0x80AD, 0x484D54343531533641465238412D50422020

USB Device: Internal Memory Card Reader

USB Device: Apple Internal Keyboard / Trackpad

USB Device: BRCM20702 Hub

USB Device: Bluetooth USB Host Controller

USB Device: Hub

USB Device: Polycom CX600

USB Device: Blynclight

USB Device: Apple Thunderbolt Display

USB Device: Display Audio

USB Device: FaceTime HD Camera (Display)

Serial ATA Device: APPLE SSD SM0256F, 251 GB

Network Service: Display Ethernet 3, Ethernet, en7

Network Service: Wi-Fi, AirPort, en0

Model: MacBookPro11,1, BootROM MBP111.0138.B15, 2 processors, Intel Core i5, 2.6 GHz, 8 GB, SMC 2.16f68

Posted on Aug 20, 2015 10:51 AM

Reply

Answer 1

Aug 20, 2015 10:53 AM in response to winintosh

Uninstall McAfee. It is totally worthless on a Mac. All it ever does is cause problems.

Reply

Answer 2

winintosh Author

Level 1

0 points

Aug 20, 2015 10:55 AM in response to winintosh

We're in the process of removing McAfee's anti-virus, which we just had on this particular machine as a test. Unfortunately, I'm about the lowest person on the totem pole in my department, so while we can get rid of the anti-virus, I am forced to use McAfee to manage the native encryption of the machine.

Is there anything in there which points to McAfee specifically? I was leaning towards something with the video driver or something.

Reply

Answer 3

Barney-15E

Level 10

122,252 points

Aug 20, 2015 11:22 AM in response to winintosh

Why are you using McAfee for encryption instead of FileVault?

The fact that McAfee is installed points to it being the problem.

Kernel Panics are cause primarily by hardware faults and crappy kernel extensions.

The panic signature is a possible memory problem (page fault), not a GPU issue.

The he best way to rule out (or in) crappy kernel extensions is to remove them and test.

Reply

Answer 4

winintosh Author

Level 1

0 points

Aug 20, 2015 11:40 AM in response to Barney-15E

Well, technically, we are using FileVault- let me explain. McAfee uses the native FileVault to encrypt the machine and then escrows the key on the McAfee epo server. As I understand it, there's no way to get FileVault, by itself, to send the key to ProfileManager or for ProfileManager to pull the key from encrypted machines. Believe me, if there was a way to get ProfileManager to store the key for enrolled machines, McAfee would be out the window.

I will definitely be removing the anti-virus portion of McAfee. We were just testing that out because auditors want macs to have anti-virus now, and McAfee is free (long story), so we're testing it out.

I've seen you help folks in other threads. So you don't believe those last two loaded and unloaded kexts are to blame(com.apple.driver.AppleUSBAudio and com.apple.driver.AppleHIDKeyboard)? I'm just trying to get a grasp on how to read the panic log. Thanks for the info about page fault. Perhaps I need to run a memtest on his machine or something, etc.

Reply

Answer 5

Barney-15E

Level 10

122,252 points

Aug 20, 2015 4:36 PM in response to winintosh

I've seen you help folks in other threads. So you don't believe those last two loaded and unloaded kexts are to blame(com.apple.driver.AppleUSBAudio and com.apple.driver.AppleHIDKeyboard)? I'm just trying to get a grasp on how to read the panic log. Thanks for the info about page fault. Perhaps I need to run a memtest on his machine or something, etc.

If Apple's kexts were causing panics, this place would be loaded with reports.

The last loaded and unloaded kexts are only places to start if they happen to be third-party extensions. It is possible for Apple's kexts to have a bug in them, but it is so rare it isn't the first place to start looking.

I purposely chose the term "memory" over "RAM" as it doesn't implicate RAM, it is just a problem in the addressing. From this document:

https://developer.apple.com/library/mac/technotes/tn2063/_index.html

The most common exceptions are:

Page faults, caused by an attempt to access data at an invalid memory address, such as dereferencing a NULL pointer.

Invalid/undefined opcode exceptions, caused by an attempt to execute an instruction with an invalid opcode.

General protection faults, caused by any of a number of conditions, including transferring execution to a non-executable code segment or writing to either a code segment or read-only data segment.

Reply

Answer 6

winintosh Author

Level 1

0 points

Aug 21, 2015 6:46 AM in response to Barney-15E

Thank you. After talking to the user, he said this did seem to start occurring after the McAfee anti-virus was installed. I'll report back after that's been removed and he's used it for a few days.

The McAfee encryption can certainly cause problems elsewhere- particularly with OS upgrades and other stuff. Although how much of that is just FileVault in general has yet to be determined. Anyhoo, thanks for your time.

Reply

Answer 7

Eric Root

Level 10

685,251 points

Aug 21, 2015 12:15 PM in response to winintosh

McAfee Uninstall Resources is near bottom of the page

Reply