Hmm, spontaneous restart message... what's it all mean?

[in2themystik2]

Alright, I did the hardware test and it said nothing was wrong. But that's not the end all be all, so I'll have to look into the next tip. Thanks for the help so far everyone!

 

[in2themystik2]

So the part of the system that's actually faulting here is pretty close to the metal -- kernel itself, iokit, nmi, mach, etc. Now these bits are pretty well tested, so panics this regular are unlikely to be originally caused by these chunks of code. Now, the backtrace [EDIT: not 'backtrace'... I mean, 'exception chain'] in those logs is a little more interesting. There, the counter's much, much higher, indicating the user-mode app which made the call to the kernel code which led to the crash. Sadly, there's no way for us here to find which program was living at that memory address when the thing blew up.

Okay, since a lot of this lingo is foreign to me, when you say "user-mode app" what exactly do you mean, in terms of which programs that might be?

 

[displaced]

Okay, since a lot of this lingo is foreign to me, when you say "user-mode app" what exactly do you mean, in terms of which programs that might be?

No problem... I thought after I'd posted that I was ranting a little, but I hope I'll manage to explain myself

All modern operating systems (OS X, Windows NT, Linux etc.) generally divide memory into two areas: kernel-space and user-space. Memory within kernel space is reserved for use entirely by the core routines of the operating system (input/output, memory management, etc) and by kernel extensions (hardware drivers, etc). Kernel space is special in that it's always in physical memory -- never moved out to the swap-file. Kernel-space code also has complete, unfettered access to the system's hardware. Generally speaking, an unhandled error in kernel-space will result in the panics you've been seeing.

User-space is the rest of memory, and where all other programs on your machine run. Everything from the Aqua user interface to Microsoft Word run in user-space. Of course, these programs often require the kernel-space code to do stuff for them. If MS Word needs to allocate more memory to itself, it asks the kernel-space code to do it. Likewise, if iTunes is playing, eventually the audio data will find itself passed into a kernel-space program before it ends up in your Mac's audio hardware.

The interface between kernel- and user-space is really crucial. Even if a user-space program talks garbage to the kernel-space (for example, sends a picture file to the audio system), this must not cause the kernel code to fall over and die. Rather, the program that sent the invalid data should take the fall.

Most traceable kernel panics are the result of a bad kernel extension. I mentioned a panic I had with a dodgy audio card driver. In this case, the fault was in the kernel extension... and an unhandled error in kernel space will cause a panic.

In your case, the source of the panic does not seem to be within kernel space. Something outside of the kernel is causing a kernel-space error, and thus, a panic.

In your logs, you'll see the PC (program counter -- basically a pointer to the bit of code your processor was running at the time) originally contains a low number (0x000<something>). That's kernel-space. Then, as the log traces the exception (the fault) back to its source, the program counter gets much higher (0x482<something>). That's user-space, and could be any program you're running.

Let's pretend the panic log traces the exception back to address 0x90000000. That's definitely user-mode, since it's so high. But we don't know what program occupied that address at that moment in time. The only way to find out would be to connect a second machine to your Mac and run an external debugger.

As I mentioned, it's really tough for a user-mode program to cause a kernel panic, since the kernel's so strict with how information's passed to it.
That's really, really tough to do. The kernel's servicing thousands of requests by user-mode programs every second (rough guess... possibly an order of magnitude out! ), and not all programs are well behaved... so it has to be incredibly strict about how programs speak to it.

So, I'd imagine the programs you're running aren't to blame. The kernel's falling over either because the kernel itself is damaged (reinstall OS X), or because of a hardware fault (disk corruption, dodgy RAM).

Good luck... I really hope you get this sorted. Fingers crossed, a quick Archive & Install reinstallation of OS X will fix it!

 

[in2themystik2]

Okay, before archiving and installing, do I need to make sure all my files are copied on another source so I don't lose them, or will they all still be there. I know I should be backing up, but I just got the computer in December so there are just some school word files on there so far. But reinstalling the OS, does that erase things, or have nothing to do with that? Sorry if this is a stupid question! thanks, you've been very helpful!

 

[displaced]

Okay, before archiving and installing, do I need to make sure all my files are copied on another source so I don't lose them, or will they all still be there. I know I should be backing up, but I just got the computer in December so there are just some school word files on there so far. But reinstalling the OS, does that erase things, or have nothing to do with that? Sorry if this is a stupid question! thanks, you've been very helpful!

Well, I'd suggest backing up your Home folder (just in case!) and making sure you've got your installers for your applications at hand.

An Archive & Install is pretty non-destructive. Boot from your OS install CD/DVD (start with the disk in the drive, and hold the C key). Be sure to choose Archive & Install in the install app. Look for the option to preserve your users' data and make sure it's selected.

Archive & Install will then move your existing /System folder, /Library folder, and other critical files into a disk image file called "Previous System 1.dmg". It will then create a new system installation, preserving your user accounts and data.

You should be able to log straight back in with all your settings and files intact. However, you may need to reinstall certain applications. But before installing anything, I'd suggest that you use Software Update to bring your machine back up to date. Then I'd use it for a while, just to see if there's any further panics. If all seems good, start reinstalling your apps.

If after this, you still get panics, I'd suggest one last thing before blaming hardware: reinstall using the Erase & Install option. Take backups of your Home folder first, then let installer completely wipe the hard disk and reinstall the system. Just to be thorough

Finally, if both an Archive & Install, and a fresh Erase & Install lead to panics, blame the hardware!

Good luck!

 

[in2themystik2]

Alright, I did the Archive and Install and I guess we'll hope for the best and see what happens. Shortly prior to doing this, I had a fourth kernal panic which means 4 within 2 weeks. Hopefully this might fix the problem and no more kernal panic! If not, well, plan B. Again, thanks for all the help!

 

[Kingsly]

No problem... I thought after I'd posted that I was ranting a little, but I hope I'll manage to explain myself

All modern operating systems (OS X, Windows NT, Linux etc.) generally divide memory into two areas: kernel-space and user-space. Memory within kernel space is reserved for use entirely by the core routines of the operating system (input/output, memory management, etc) and by kernel extensions (hardware drivers, etc). Kernel space is special in that it's always in physical memory -- never moved out to the swap-file. Kernel-space code also has complete, unfettered access to the system's hardware. Generally speaking, an unhandled error in kernel-space will result in the panics you've been seeing.

User-space is the rest of memory, and where all other programs on your machine run. Everything from the Aqua user interface to Microsoft Word run in user-space. Of course, these programs often require the kernel-space code to do stuff for them. If MS Word needs to allocate more memory to itself, it asks the kernel-space code to do it. Likewise, if iTunes is playing, eventually the audio data will find itself passed into a kernel-space program before it ends up in your Mac's audio hardware.

The interface between kernel- and user-space is really crucial. Even if a user-space program talks garbage to the kernel-space (for example, sends a picture file to the audio system), this must not cause the kernel code to fall over and die. Rather, the program that sent the invalid data should take the fall.

Most traceable kernel panics are the result of a bad kernel extension. I mentioned a panic I had with a dodgy audio card driver. In this case, the fault was in the kernel extension... and an unhandled error in kernel space will cause a panic.

In your case, the source of the panic does not seem to be within kernel space. Something outside of the kernel is causing a kernel-space error, and thus, a panic.

In your logs, you'll see the PC (program counter -- basically a pointer to the bit of code your processor was running at the time) originally contains a low number (0x000<something>). That's kernel-space. Then, as the log traces the exception (the fault) back to its source, the program counter gets much higher (0x482<something>). That's user-space, and could be any program you're running.

Let's pretend the panic log traces the exception back to address 0x90000000. That's definitely user-mode, since it's so high. But we don't know what program occupied that address at that moment in time. The only way to find out would be to connect a second machine to your Mac and run an external debugger.

As I mentioned, it's really tough for a user-mode program to cause a kernel panic, since the kernel's so strict with how information's passed to it.
That's really, really tough to do. The kernel's servicing thousands of requests by user-mode programs every second (rough guess... possibly an order of magnitude out! ), and not all programs are well behaved... so it has to be incredibly strict about how programs speak to it.

So, I'd imagine the programs you're running aren't to blame. The kernel's falling over either because the kernel itself is damaged (reinstall OS X), or because of a hardware fault (disk corruption, dodgy RAM).

Good luck... I really hope you get this sorted. Fingers crossed, a quick Archive & Install reinstallation of OS X will fix it!

*picks remnants of my brain off the ground and hides in a corner*

Seriously, thanks for the lesson. Now I know!
In Activity monitor, would kernel space be the RAM that is WIRED, ACTIVE or neither??

 

[displaced]

*picks remnants of my brain off the ground and hides in a corner*

Seriously, thanks for the lesson. Now I know!
In Activity monitor, would kernel space be the RAM that is WIRED, ACTIVE or neither??

Hehe... no problem... I hope it made sense!

Memory containing kernel-space code would most likely be 'wired'. Wired memory will not be paged-out to the disk-based virtual memory, and that suits kernel-code just fine.

This probably will be more than just the actual code for the kernel. It'll also include system-critical structures... things like process tables, certain caches, etc. There's probably more detail on Apple's Darwin docs somewhere.

 

[in2themystik2]

Just when I thought it was fixed...

Well, I did the archive and install on the 20th, and had no kernal panics since, and thought all was going well.... until five minutes ago... when I got another one. There again, I wasn't really doing anything out of the ordinary. The only thing I have been doing new in the last month is using ebay. I guess now I'll have to do a clean install? Gah... Any other thoughts? Thanks again...

 

[in2themystik2]

This is for my most recent kernal panic. I tried to compare to the old ones, and all I am able to determine, is it looks a little different. Does any of this tell me anything helpful? thanks!


Mon Apr 24 23:07:37 2006


Unresolved kernel trap(cpu 0): 0x300 - Data access DAR=0x0000000000A5FF50 PC=0x000000000003C148
Latest crash info for cpu 0:
Exception state (sv=0x2EB5A500)
PC=0x0003C148; MSR=0x00001030; DAR=0x00A5FF50; DSISR=0x40000000; LR=0x0003C06C; R1=0x17F62CB0; XCP=0x0000000C (0x300 - Data access)
Backtrace:
0x00000000 0x002D05E4 0x002D0240 0x2DBBC2AC 0x2DBBC548 0x2DBBC054
0x2DBBBD00 0x2DBBBC9C 0x002CDC6C 0x2DBBBC54 0x2DBB7B10 0x2DFC1ECC 0x2DFC4360 0x2DFC63F8
0x2DF663A8 0x2DF6902C 0x2DF6C2F0 0x2DF6B474 0x2DF67E6C 0x2DF679DC 0x2DF71A64 0x2DF77808
0x2DF71A64 0x2DF74F6C 0x2DF73E98 0x001077A8 0x000D4B4C 0x000FCFC4 0x000DA9E0 0x000DB220
0x002295B4 0x000FC7E0
backtrace continues...
Kernel loadable modules in backtrace (with dependencies):
com.apple.iokit.IOATABlockStorage(1.4.1)@0x2dfc0000
dependency: com.apple.iokit.IOStorageFamily(1.4)@0x2df62000
dependency: com.apple.iokit.IOATAFamily(1.6.0f2)@0x2dbb6000
com.apple.iokit.IOStorageFamily(1.4)@0x2df62000
com.apple.iokit.IOATAFamily(1.6.0f2)@0x2dbb6000
Proceeding back via exception chain:
Exception state (sv=0x2EB5A500)
previously dumped as "Latest" state. skipping...
Exception state (sv=0x37174000)
PC=0x900D2C60; MSR=0x0000D030; DAR=0xA000D0B0; DSISR=0x40000000; LR=0x900D2C38; R1=0xF0080A60; XCP=0x0000000C (0x300 - Data access)

Kernel version:
Darwin Kernel Version 8.2.1: Fri Jun 24 23:31:10 PDT 2005; root:xnu-792.3.2.obj~1/RELEASE_PPC
panic(cpu 0 caller 0xFFFF0003): 0x300 - Data access
Latest stack backtrace for cpu 0:
Backtrace:
0x00095544 0x00095A5C 0x0002683C 0x000A819C 0x000ABB00
Proceeding back via exception chain:
Exception state (sv=0x2EB5A500)
PC=0x0003C148; MSR=0x00001030; DAR=0x00A5FF50; DSISR=0x40000000; LR=0x0003C06C; R1=0x17F62CB0; XCP=0x0000000C (0x300 - Data access)
Backtrace:
0x00000000 0x002D05E4 0x002D0240 0x2DBBC2AC 0x2DBBC548 0x2DBBC054
0x2DBBBD00 0x2DBBBC9C 0x002CDC6C 0x2DBBBC54 0x2DBB7B10 0x2DFC1ECC 0x2DFC4360 0x2DFC63F8
0x2DF663A8 0x2DF6902C 0x2DF6C2F0 0x2DF6B474 0x2DF67E6C 0x2DF679DC 0x2DF71A64 0x2DF77808
0x2DF71A64 0x2DF74F6C 0x2DF73E98 0x001077A8 0x000D4B4C 0x000FCFC4 0x000DA9E0 0x000DB220
0x002295B4 0x000FC7E0
backp
*********

 

[Heb1228]

I would say if your memory is 2 512 sticks, take one out and use it for a while and see what happens. If no kernel panics, then swap them out and use the other 512 stick. See if its one of the memory modules. I know you got it from apple, so its not likely to be a problem... but I really think you need to rule out bad memory.

 

[in2themystik2]

Might memory be bad even if the Hardware test said that nothing is wrong? I honestly have no idea how to take out RAM, although I know there are guides online on how to do it. It just makes me a little nervous to think of taking my iBook apart. I could end up doing real damage! If I never had this problem until a few weeks ago, even though i've had the computer since mid December, could it still be the RAM, the problem just not showing up until now? hmmm

 

[mad jew]

More often than not, those hardware tests won't find bad memory (among other things). They're kinda a waste of time in most cases. iFixit has a guide on how to install memory. This should help you with taking it out too.

 

[marchcapital]

This could potentially be a serious problem. I hade my iBook for 15 days when it started, and i got Kernal Panics very frequently. So i called apple and went through all the software test procedures. In the end, they concluded that it was an internal hardware issue and i got a replacment.

If the kernal panics on your iBook persist and its still under warranty, before sending it out for repair call apple, and tell tech that you have been having an unacceptable amount of trouble with your mac and that you would like to speak with Customer Relations. Explain your situation to them, they may replace your iBook.

 

[in2themystik2]

Alright, well, I think I'm going to back everything up, and then do a clean install... We'll see what happens...

 

[BurtonCCC]

Mine has done that twice while I was plugging my M-Audio MobilePre in for use with GarageBand. I guess it's like the Windoww blue screen of death, but you can actually restart you computer and nothing appears wrong.

If it means you need the repair your permissions, there's a program called Maintenance that's free in the OS X Downloads section of the Apple website. I use that every week or so and my computer's been running quite well since (not that it ever hasn't, haha).

Daniel.

 

[in2themystik2]

Well, i did a clean reinstall of the operating system, and I forgot what a pain in the booty it would be... I backed up the important files. But now I have to remember and re-find all the things I had on here before that I liked... I guess we'll see what happens. Hopefully no kernal panic, but if I do, it's time to go to Apple.