MBP + SSD + FileVault2 = Kernel Panics

[obdave]

Hello - I'm hoping someone here might be able to offer some insight into something I'm seeing. I've Googled and not found the specific set of weirdnesses I'm seeing.

I have a 13-inch Mid 2009 MBP. About six months ago I installed a 256 GB Intel SSD, and love the performance. It's hard to go back to a spinning platter after you've lived with an SSD for awhile. At the time I installed the SSD I was running Snow Leopard and I used Trim Enabler to enable TRIM support. Zero issues.

After 10.8.1 was released I upgraded to Mountain Lion, and downloaded the latest Trim Enabler to re-enable TRIM. A week later 10.8.2 became available and I installed the update and again re-enabled TRIM. Apart from battery life issues the machine runs very reliably.

Everything worked great until about two weeks ago when I enabled FileVault2. Ever since then, the machine kernel panics at login about 20% of the time. If it gets past the KP it seems to run fine, but in 5 years of owning 3 Macs, I had never seen a kernel panic ever up until this point. Here are some additional clues:

1) I used Carbon Copy Cloner to clone the SSD to a 7200 RPM WD Scorpio Black HDD, and swapped the drives. I never see Kernel Panics when running the HDD.

2) I thought that maybe Trim Enabler had corrupted the Kernel (even though that issue with earlier versions of Trim Enabler has since been resolved). Today's experiment: I put the SSD back in the MBP and made a bootable 10.8.2 installer on a USB stick. I did a complete re-install of the OS. Interestingly enough, the install kept the encrypted disk image. It asked me for a password to unlock the disk, and then proceeded to re-install 10.8.2 on the encrypted disk. When it finished, the first time it rebooted I got a kernel panic. I went into About The Mac and determined that Trim was not enabled, which is what I expected. (i.e. I think I have successfully restored to a pre-Trim Enabler state, which would eliminate Trim Enabler as a cause).

3) I went into System Prefs and turned off FileVault2. When the machine finished decrypting the disk, I rebooted. No Kernel Panic. And I see that I'm back to the regular login (not the FileVaulted login). I've rebooted the machine about 20 times and no kernel panics.

So I don't think it's Trim Enabler after all. Just the combination of my SSD and FileVault are enough to make my machine KP at login. I don't know why. Suggestions?

Here's a sample KP:

----snip---


Interval Since Last Panic Report: 499670 sec
Panics Since Last Report: 1
Anonymous UUID:

Tue Oct 23 18:27:08 2012
panic(cpu 0 caller 0xffffff800ceb7bd5): Kernel trap at 0xffffff7f8de93578, type 13=general protection, registers:
CR0: 0x000000008001003b, CR2: 0xffffff80ee8ce000, CR3: 0x000000000fb03000, CR4: 0x0000000000000660
RAX: 0x0000000012cfb21f, RBX: 0x01ffff801efcd000, RCX: 0x00000000658f72f3, RDX: 0x0000000000000000
RSP: 0xffffff80f40c3e50, RBP: 0xffffff80f40c3e60, RSI: 0x0000000000000002, RDI: 0xffffff800d401ef0
R8: 0x0000000000000001, R9: 0x00000000000003ff, R10: 0xffffffffffffffff, R11: 0x00000000ffffffff
R12: 0xffffff801efcd000, R13: 0xffffff801ebd1900, R14: 0xffffff801ef70100, R15: 0x0000000000000001
RFL: 0x0000000000010246, RIP: 0xffffff7f8de93578, CS: 0x0000000000000008, SS: 0x0000000000000000
Fault CR2: 0xffffff80ee8ce000, Error code: 0x0000000000000000, Fault CPU: 0x0

Backtrace (CPU 0), Frame : Return Address
0xffffff80f40c3af0 : 0xffffff800ce1d626
0xffffff80f40c3b60 : 0xffffff800ceb7bd5
0xffffff80f40c3d30 : 0xffffff800cece4ed
0xffffff80f40c3d50 : 0xffffff7f8de93578
0xffffff80f40c3e60 : 0xffffff800d23181b
0xffffff80f40c3ea0 : 0xffffff800d23133e
0xffffff80f40c3f30 : 0xffffff800d22d2d0
0xffffff80f40c3f70 : 0xffffff800d231e99
0xffffff80f40c3fb0 : 0xffffff800ceb26b7
Kernel Extensions in backtrace:
com.apple.driver.AppleUSBOHCI(5.2.5)[1C94C4BC-B05C-36D4-B1A2-B0BE04A5C620]@0xffffff7f8de92000->0xffffff7f8dea4fff
dependency: com.apple.iokit.IOUSBFamily(5.4.0)[C3094550-7F58-3933-A4F7-CD33AE83F8B9]@0xffffff7f8dbab000
dependency: com.apple.iokit.IOPCIFamily(2.7.2)[B1B77B26-7984-302F-BA8E-544DD3D75E73]@0xffffff7f8d472000

BSD process name corresponding to current thread: kernel_task

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64
Kernel UUID:
Kernel slide: 0x000000000cc00000
Kernel text base: 0xffffff800ce00000
System model name: MacBookPro5,5 (Mac-F2268AC8)

System uptime in nanoseconds: 941471620
last loaded kext at 282686089: com.apple.iokit.IOAHCISerialATAPI 2.5.0 (addr 0xffffff7f8e298000, size 53248)
loaded kexts:
com.apple.iokit.IOAHCIBlockStorage 2.2.2
com.apple.driver.AirPort.Brcm4331 602.15.22
com.apple.driver.AppleIntelCPUPowerManagementClient 196.0.0
com.apple.driver.AppleUSBHub 5.2.5
com.apple.driver.AppleFWOHCI 4.9.6
com.apple.driver.AppleAHCIPort 2.4.1
com.apple.nvenet 2.0.19
com.apple.driver.AppleUSBEHCI 5.4.0
com.apple.driver.AppleUSBOHCI 5.2.5
com.apple.driver.AppleRTC 1.5
com.apple.driver.AppleEFINVRAM 1.6.1
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleHPET 1.7
com.apple.driver.AppleACPIButtons 1.6
com.apple.driver.AppleSMBIOS 1.9
com.apple.driver.AppleACPIEC 1.6
com.apple.driver.AppleAPIC 1.6
com.apple.nke.applicationfirewall 4.0.39
com.apple.security.quarantine 2
com.apple.driver.AppleIntelCPUPowerManagement 196.0.0
com.apple.iokit.IOAHCISerialATAPI 2.5.0
com.apple.iokit.IOSCSIArchitectureModelFamily 3.5.1
com.apple.iokit.IO80211Family 500.15
com.apple.iokit.IOUSBUserClient 5.2.5
com.apple.iokit.IOFireWireFamily 4.5.5
com.apple.iokit.IOAHCIFamily 2.2.1
com.apple.iokit.IONetworkingFamily 3.0
com.apple.iokit.IOUSBFamily 5.4.0
com.apple.driver.NVSMU 2.2.9
com.apple.driver.AppleEFIRuntime 1.6.1
com.apple.iokit.IOHIDFamily 1.8.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 220
com.apple.kext.AppleMatch 1.0.0d1
com.apple.security.TMSafetyNet 7
com.apple.driver.DiskImages 344
com.apple.iokit.IOStorageFamily 1.8
com.apple.driver.AppleKeyStore 28.21
com.apple.driver.AppleACPIPlatform 1.6
com.apple.iokit.IOPCIFamily 2.7.2
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.corecrypto 1.0
Model: MacBookPro5,5, BootROM MBP55.00AC.B03, 2 processors, Intel Core 2 Duo, 2.53 GHz, 8 GB, SMC 1.47f2
Graphics: NVIDIA GeForce 9400M, NVIDIA GeForce 9400M, PCI, 256 MB
Memory Module: BANK 0/DIMM0, 4 GB, DDR3, 1067 MHz, 0x859B, 0x435435313236344243313036372E4D313646
Memory Module: BANK 1/DIMM0, 4 GB, DDR3, 1067 MHz, 0x859B, 0x435435313236344243313036372E4D313646
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x8D), Broadcom BCM43xx 1.0 (5.106.98.81.22)
Bluetooth: Version 4.0.9f33 10885, 2 service, 18 devices, 1 incoming serial ports
Network Service: AirPort, AirPort, en1
Serial ATA Device: INTEL SSDSC2CW240A3, 240.06 GB
Serial ATA Device: HL-DT-ST DVDRW GS23N
USB Device: Built-in iSight, apple_vendor_id, 0x8507, 0x24400000 / 2
USB Device: Internal Memory Card Reader, apple_vendor_id, 0x8403, 0x26500000 / 2
USB Device: MobilePre, 0x0763 (M-Audio), 0x200f, 0x04100000 / 4
USB Device: Apple Internal Keyboard / Trackpad, apple_vendor_id, 0x0236, 0x04600000 / 3
USB Device: IR Receiver, apple_vendor_id, 0x8242, 0x04500000 / 2
USB Device: BRCM2046 Hub, 0x0a5c (Broadcom Corp.), 0x4500, 0x06100000 / 2
USB Device: Bluetooth USB Host Controller, apple_vendor_id, 0x8213, 0x06110000 / 4

 

[obdave]

Wow. OK, so just now I booted off the USB stick, ran Disk Utility and erased the SSD. Then did a completely clean install of 10.8.2. Did not run the migration assistant thing, so I have a totally squeaky-clean install. Turned on FileVault. When the machine rebooted to begin the encryption, it immediately had a kernel panic. Gah.

FileVault hates my SSD.

 

[Transeau]

have you tried swapping in the memory it came with?
it seems to me that this would be a failing memory or CPU issue.
FileVault2 makes heavy use of the AES-XT instructions in the newer CPUs. When that isn't available, it requires more CPU and memory to do the encryption.

It seems to me that if everything worked before, then something is failing now.

 

[obdave]

Thanks for the reply. The HDD is also FileVault encrypted and I have no issues when using the HDD, only the SSD.

 

[Transeau]

I would do this...

1 - attach the SSD via USB to a running Mac
2 - Use the Diskutil command from the terminal to completely wipe out the drive
3 - Use Disk Utility to create a clean GPT partition, formatted HFS+ with no encryption
4 - Do a clean install with the SSD in the MBP
5 - install any updates needed
6 - Enable FileVault2

My gut feeling is still memory, but if the HDD was working correctly with FileVault2 enabled, then it must be the cloning that caused it. I have 3 MBP's here at home. Mine (late 2011, dual 240GB ssd), My wife's (early 2011, 128 ssd, 750 hdd), and my daughter's (2009, 128 SSD). All three have FV2 enabled, and all three have trim support enabled. However, all were clean installs and the the encryption turned on once everything was running.

I don't think anyone really knows 100% how Apple implemented this - I suppose there is a chance that it could be tired to hardware...?

Let me know if you try this. I've always been fascinated by CoreStorage and how it's implemented with the OS as well as the EFI. I'm curious as to what is causing your issues. I may even try to reproduce it on my daughter's. Through I don't have any Intel SSDs. I've stuck to Mushkin and OCZ for mine.

 

[obdave]

Thanks, I will try that next. I'm running the extended Apple Hardware Test right now.

 

[obdave]

OK, the extended hardware test ran for a few hours with no errors reported.

I verified that the Intel drive is running the latest version of firmware. I also verified that I'm running the latest EFI and SMC. Zapped the PRAM and reset the SMC.

I booted off the 10.8.2 thumbdrive, ran Disk Utility and deleted the Mac partition on the SSD, then created a new one from scratch. Installed OSX. Checked for updates So fresh partition, fresh OS. Rebooted a coupe times, no problems.

Turned on FileVault. When it finished, rebooted and immediately got a kernel panic at login.

It's something about the SSD and FileVault 2.

After doing some googling last night, I'm reading a lot about problems with the NVidia SATA chipset, in particular some serious incompatibilities with the Sandforce controllers used in many SSDs, including my Intel SSD.

These don't point directly to Filevault, but something bad happens with the SSD at boot when is Filevault enabled. I think I'm screwed. I suspect my only option with this MBP is to either go back to HDD or forego FileVault.

----snip---


Mon Nov 5 12:34:35 2012
panic(cpu 0 caller 0xffffff8019ab7bd5): Kernel trap at 0xffffff8019a2da10, type 13=general protection, registers:
CR0: 0x000000008001003b, CR2: 0xffffff80fb3f5000, CR3: 0x000000001c6a1000, CR4: 0x0000000000000660
RAX: 0x0000000000000001, RBX: 0xffffff802be52aa0, RCX: 0x0000000009000000, RDX: 0xffffff80f5396078
RSP: 0xffffff8100bfbe50, RBP: 0xffffff8100bfbe80, RSI: 0xffffff80f5396068, RDI: 0x0000000000000000
R8: 0xffffff801a0bec60, R9: 0xffffffffffffffff, R10: 0x00000000ffffffff, R11: 0x00000000ffffff80
R12: 0xffffff801a0bebe8, R13: 0xffffff802be4cad0, R14: 0x01ffff802be4caa0, R15: 0x0000000000000000
RFL: 0x0000000000010002, RIP: 0xffffff8019a2da10, CS: 0x0000000000000008, SS: 0x0000000000000000
Fault CR2: 0xffffff80fb3f5000, Error code: 0x0000000000000000, Fault CPU: 0x0

Backtrace (CPU 0), Frame : Return Address
0xffffff8100bfbaf0 : 0xffffff8019a1d626
0xffffff8100bfbb60 : 0xffffff8019ab7bd5
0xffffff8100bfbd30 : 0xffffff8019ace4ed
0xffffff8100bfbd50 : 0xffffff8019a2da10
0xffffff8100bfbe80 : 0xffffff8019e2e1e9
0xffffff8100bfbec0 : 0xffffff8019e2ca47
0xffffff8100bfbf30 : 0xffffff8019e2d3a2
0xffffff8100bfbf70 : 0xffffff8019e31e99
0xffffff8100bfbfb0 : 0xffffff8019ab26b7

BSD process name corresponding to current thread: kernel_task

Mac OS version:
Not yet set

Kernel version:
Darwin Kernel Version 12.2.0: Sat Aug 25 00:48:52 PDT 2012; root:xnu-2050.18.24~1/RELEASE_X86_64
Kernel UUID:
Kernel slide: 0x0000000019800000
Kernel text base: 0xffffff8019a00000
System model name: MacBookPro5,5 (Mac-F2268AC8)

System uptime in nanoseconds: 1231252501
last loaded kext at 921958359: com.apple.driver.AirPort.Brcm4331 602.15.22 (addr 0xffffff7f9aeae000, size 2265088)
loaded kexts:
com.apple.driver.AirPort.Brcm4331 602.15.22
com.apple.driver.AppleFWOHCI 4.9.6
com.apple.nvenet 2.0.19
com.apple.driver.AppleAHCIPort 2.4.1
com.apple.driver.AppleEFINVRAM 1.6.1
com.apple.driver.AppleIntelCPUPowerManagementClient 196.0.0
com.apple.driver.AppleUSBEHCI 5.4.0
com.apple.driver.AppleUSBOHCI 5.2.5
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleRTC 1.5
com.apple.driver.AppleHPET 1.7
com.apple.driver.AppleACPIButtons 1.6
com.apple.driver.AppleSMBIOS 1.9
com.apple.driver.AppleACPIEC 1.6
com.apple.driver.AppleAPIC 1.6
com.apple.nke.applicationfirewall 4.0.39
com.apple.security.quarantine 2
com.apple.driver.AppleIntelCPUPowerManagement 196.0.0
com.apple.iokit.IO80211Family 500.15
com.apple.iokit.IOFireWireFamily 4.5.5
com.apple.iokit.IONetworkingFamily 3.0
com.apple.iokit.IOAHCIFamily 2.2.1
com.apple.driver.NVSMU 2.2.9
com.apple.iokit.IOUSBFamily 5.4.0
com.apple.driver.AppleEFIRuntime 1.6.1
com.apple.iokit.IOHIDFamily 1.8.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 220
com.apple.kext.AppleMatch 1.0.0d1
com.apple.security.TMSafetyNet 7
com.apple.driver.DiskImages 344
com.apple.iokit.IOStorageFamily 1.8
com.apple.driver.AppleKeyStore 28.21
com.apple.driver.AppleACPIPlatform 1.6
com.apple.iokit.IOPCIFamily 2.7.2
com.apple.iokit.IOACPIFamily 1.4
com.apple.kec.corecrypto 1.0

 

[mlbarnes]

Similar Configuration, Kernel Panics

Just to add - I have a Mid-2010 13MBP with a 160Intel SSD. Since enabling File Vault2, I have had similar intermittent kernel panics also. In fact I'm here now because after repartitioning (removing Bootcamp) I have nothing BUT kernel panics - will not boot at all.
I used Drive Genius and have now managed to scrub the whole drive too (really not great documentation provided with the 'Reset Partition' option on it)!
Anyway, if I can retrieve the panic I will and update it here - it might be related. Let me know if you make any progress.
I have NOT used Trim enabler.

 

[murphychris]

The support Apple has in this area is very incomplete. FileVault 2 uses a kind of encryption that encrypts every sector on the drive, not just the ones in use. This forward conversion, is why it takes so long. It means even deleted files on the disk encrypted. However, every sector on the SSD is now in-use as far as the SSD is concerned, and that significantly, or totally inhibits its ability to do garbage collection.

I don't know if OS X issues a TRIM command for all free LBA's after this conversion, on Apple's SSDs. That would be logical, or there'd be a pretty big performance hit right after conversion.

However, there is another kind of disk encryption that Apple supports that doesn't encrypt every sector, rather just the ones being written to. This is the encryption available to non-boot disks if you go to Disk Utility and choose one of the encryption format options. And that whole disk, or partition, is encrypted from the moment it's formatted, with zero conversion time. Yet for some inexplicable reason I can't think of, this type of encryption isn't available at OS X installation time, which would be a kinds of FDE compatible with 3rd party SSDs. This is how it's done on Linux using LUKS encryption.

The better way to do FDE is on the SSD itself, but Apple doesn't give us the ability to access this feature in any drives that have it.

So across the board Apple does not seem particularly interested in playing nice with 3rd party SSDs.

 

[kevink2]

I'm not sure how much I trust Filevault2 now.

Twice in the last 8 months something has happened, and when I attempted to boot the boot loader couldn't find a bootable partition.

The first time, I didn't know much about encryption, and didn't realize I could possibly try an internet recovery to run disk utility. My recent data had been backed up online, so I just did a fresh install.

A month or 2 later, I replaced my drive with a SSD drive for added speed (and prices had come down).

Well, Wednesday it did it again. Ran diskutility from COMMAND+R, it didn't see anything wrong in the partition, or when I told it to check the whole drive. I reset the Startup volume in it. Nothing. Wouldn't boot off of SSD.

Nothing I tried suggested on the web worked.

Ran the Apple hardware diagnostics. No problems found, including memory.

I started the laptop up in Firewall Target mode, and I could see all the data from my Mac Pro. So I copied the whole hard drive partition to my Pro. Sometime, during the copy, it detected some HFS errors involving siblings. Well, once this happened, I ended up with a partition that disk utility couldn't fix, though a command line fsck fixed it. Still not bootable.

Luckily, after last year's issue, I started a time machine backup to an USB hard drive. I was able to restore from that, then replaced the updated files from my Mac backup. Everything seems to be working fine the last few hours, other than having to reenter a couple passwords.

Why this happened? Since it happened with both a HDD and SSD, I'm not blaming the SSD. If it is the memory or motherboard, the tests didn't find anything. Seems like it could be an obscure bug somewhere.

So I think I'll run without encryption for awhile. If something happens in the next month or so, then it isn't filevault.

If nothing happens, then I have to decide which risk to take. Possible corruption requiring a restore (more frequent backups can help, now it is only about once a week). Or a risk that if the computer is lost/stolen away from home without encryption to protect privacy.