Location of Kernel Panic Logs

[KirbySaysHi]

I'm running 10.5.1, and for the most part things seem to work really well. Occasionally, I get random kernel panics (at least, they appear to be, all I see are the "you need to restart your computer")...

 

Is there a log somewhere that I can look at that actually contains relevant information? I've looked through some of the console output (from the console app in the utilities folder), and i never see any panic information.

 

Is there some other application I should be using?

 

Thanks for the help!

[socal swimmer]

no

 

and it makes me angry. They appear on intel macs but not hackintosh.

 

I read of a debug kernel that saves logs somewhere....

 

I have been looking into this because I am having similar problems.

[KirbySaysHi]

But if we're running vanilla kernels...

 

Is there a process, like a crash dumper or something, that doesn't get a chance to run before the computer fully locks up?

 

Social Swimmer: two things... one, did you try the lan ROM boot speeder upper fix thing I posted at the end of your install guide? two, are your problems having anything to do with your dvd drive hanging, or direct drive access (like using vmware)?

[Korrupted]

I'm almost 100% certain that iHacks don't have kernel panic logs, since they lack NVRAM, which is where real Macs store them, I believe.

[socal swimmer]

But if we're running vanilla kernels...

 

Is there a process, like a crash dumper or something, that doesn't get a chance to run before the computer fully locks up?

 

Social Swimmer: two things... one, did you try the lan ROM boot speeder upper fix thing I posted at the end of your install guide? two, are your problems having anything to do with your dvd drive hanging, or direct drive access (like using vmware)?

 

1) yes i did and THANK YOU!! omg soooo much faster !!

 

2) I do. If the drive isn't acessed for too long, then it becomes unresponsive, and prevents shutdown, freezes disk utility (if i open it) and won't eject. Annoying, but avoidable. This only happens on certain things (like movie dvds, cds, windows stuff). VMware can access the dvd (i don't know if it can after too long) but I get b0 errors if i try to boot my vista partition.

 

I am researching how to setup a crash dump system, but I'm not sure. I'm looking at FreeBSD stuff but I don't know exactly how much I could transfer over.

 

I'm pretty noobish in this area but I will give it a shot...

[KirbySaysHi]

DaxTsurugi: Thanks for the response; if that's true, then it sure is a bummer. So thanks for the info.

 

I was researching a bit, and discovered the apple kernel development kit. It comes with a debug kernel, and tools for catching kernel panics and such, but only over a network. Thus, we'd need two hackintoshes, one would be the machine we want to test, and the other would be the logger/catcher of panics. The one main caveot seems to be that both machines have to be running the same version of os x. Since only one of my machines can run leopard, I'm kind of screwed.

 

http://developer.apple.com/sdk/

Link to the debug kit...

 

http://developer.apple.com/documentation/D...000701/CJBHCEGD

How to setup "Two Machine Debugging"

 

It actually doesn't seem too difficult, minus the whole "we're on hackintoshes" thing.

 

Is this what the kernel developers, like JaS, ToH, Semthex, etc, used?

 

SocialSwimmer: If you figure anything out about this optical drive thing (what you described is exactly what seems to happen to me as well), let me know. I'll do vice versa.

[socal swimmer]

I love you!!!

 

will do.

 

thank you! now I must get my dad to update his iMac to 10.5...

[socal swimmer]

ok well i found this guide on setting up 2-machine debugging.

 

http://developer.apple.com/documentation/D..._section_4.html

 

but the first step is to do this:

 

$nvram boot-args="debug=0x144"

 

but when I do it, I get

"nvram: nvram is not supported on this system."

 

because hackintoshes don't have nvram of course. So I am wondering if this would work without nvram or not. Every other command in the guide works.

 

So I may try this soon, when I can convince my dad to upgrade his G5 iMac to leopard...

[KirbySaysHi]

Well, it turns out you don't really need the two machines.

 

If at the boot prompt you type (without the quotes) "debug=0x100", the graphical kernel panic screen gets disabled! Thus, if a panic occurs, you get a text overlay that looks just like a boot panic!

 

I forced a panic by running two VMs, itunes, adobe updater, disk utility, (still running great...) and then Cyberduck ftp initiated the panic. While I know this sounds extreme in terms of programs, my machine can handle it. Also, it's crashed on much less; I was just trying to induce a panic before I went to bed.

 

The results of the panic:

 

It seems that something with AppleVIAATA, and the internal kexts, of com.apple.iokit.IOATAFamily and com.apple.iokit.IOPCIfamily. This makes a little sense, since my computer always seems to crash when dealing with disk access, and not sheer computing power or ram.

 

Does anyone know if there's a way to make my AppleVIAATA kext more stable? Perhaps I need to wait till 10.5.2? Perhaps there's a hacked one out there for ICH9R chipsets?

 

Social Swimmer! I feel as though we might be making progress! I had just borrowed a macbook from the library to do this whole debugging thing... and it looks like we don't need it.

 

Post the results of your panic! I'll try doing some more research tomorrow. Now, it is time for bed.

[socal swimmer]

It seems that something with AppleVIAATA, and the internal kexts, of com.apple.iokit.IOATAFamily and com.apple.iokit.IOPCIfamily. This makes a little sense, since my computer always seems to crash when dealing with disk access, and not sheer computing power or ram.

 

Does anyone know if there's a way to make my AppleVIAATA kext more stable? Perhaps I need to wait till 10.5.2? Perhaps there's a hacked one out there for ICH9R chipsets?

 

Post the results of your panic! I'll try doing some more research tomorrow. Now, it is time for bed.

 

ok well I typed out the entire panic dump in a text file:

 

panic(cou 0 caller 0x00427BC7): "getPhysicalSegment() out of 32b range 0x10e1e0000, len 0x1000, class IOGeneralMemoryDescriptor"@/SoirceCache/xnu/xnu-1228.0.2.iokit/Kernel/IOMemoryDescriptor.cpp:1471
Debugger called: <panic>
Backtrace, Format - Frame : Return Address (4 potential args on stack)

16 lines of hex {censored}


	Backtrace conitnues...
Kernel loadable modules in backtrace (wih dependencies):
	com.apple.iokit.IOATABlocksStorage(1.4.4)A0x5b490000->0x52499fff
		dependency: com.apple.iokit.IOStorageFamily(1.5.2)@0x5aac2000
		dependency: com.apple.iokit.IOATAFamily(1.7.1f4)@0x5ae2d000
	com.apple.driver.AppleVIAATA(1.0.2)@0x5b048000->0x5b04dfff
		dependency: com.apple.iokit.IOPCIFamily(2.4)@0x54670000
		dependency: com.apple.iokit.IOATAFamily(1.7.1f4)@0x5ae2d000
	com.apple.iokit.IOATAFamily(1.7.1f4)0x5ae2d000->0x5ae39fff
	com.apple/iokit.IOStorageFamily(1.5.2)@0x5aac2000->0x5aad9fff

BSD process name corresponding to current thread: mds

Mac OS version:
9B18

Kernel version:
Darwin Kernel Version 9.1.0: Wed Oct 31 17:46:22 PDT 2007; root:xnu-1228.0.2~1/RELEASE_I386
Sstem model name: P35-DS3P

 

To crash my computer, I used bc to calculate the square root of 2 to 1 million decimal places . Also, I will play a 1.5 hour mp4 video and walk away (go to school, etc) and when I come back, its crashed.

 

what install method did you use? I used brazilmac. Originally I though it was the AppleACPIPlatform.kext causing the panic, but obviously I was wrong.

 

I was thinking maybe I would download kalyway and iATKOS to see if they had different versions of those kexts...

[socal swimmer]

ok I figured out that at one point, I had already downloaded kalyway... So I opened it up with Pacifist, and extracted the 5 kernel extensions that were involved in my kernel panic "log". I ran a diff with them, and the ones in my extensions folder (I included AppleACPIPlatform as well for other reasons) and the only one that was different was IOATAFamily.kext.So, I just booted in single user mode and inserted the AppleACPIPlatform.kext, and IOATAFamily.kext into my extensions folder (as well as all the chmod, chown, rm jazz). So we will see if this helps. It is interesting, because IOATAFamily was involved in 3 out of 4 kexts that took part in the crash.I can email those 5 kexts from kalyway if you want, or you can download kalyway yourself. Actually I don't even know if this will help.I added "debug=0x100" to my com.apple.Boot.plist under Kernel Flags.EDIT: lately, System Profiler will lock up if I click on "Serial-ATA"well not such a good ideaI can't start up without a kernel panic. i don't know why but I am going back to my old IOATAFamily.kext...

[socal swimmer]

More info:

 

I googled "getPhysicalSegment() out of 32b range". It turns out that this is a command which only deals with 32-bit memory addresses. So if it tryes to access memory outside this range (greater than 2 or 3 GB) it fails, which causes a kernel panic. Many mac pro users have gotten this (Parallels, WoW with 7300GT) when they had more than 2GB of memory installed.

 

Also, "mds" is always the active process according to my kernel panic log. i.e. spotlight. However, generic (real mac) KP logs do not show the active process.

 

If we can find the place where this command is called, and replace it with IODMAController or getPhysicalSegment64(), we should be fine. I found that info here.

 

are you still having the problems?

 

here is my personal notes on the problem:

 

http://lists.apple.com/archives/darwin-drivers/2006/Oct/msg00012.html

getPhysicalSegment() only works for 32-bit addresses. Using on intel macs with more than 2GB RAM causes kernel panics. He should use IODMACommand

[url="http://forum.parallels.com/thread4121.html"]New Mac Pro version of Parallels Desktop causing kernel panics ...[/url]


they were all having kernel panics on parallels, over 2GB of RAM

http://forums.worldofwarcraft.com/thread.html?topicId=27883585&sid=1


kernel panics with more than 2GB on WoW, using the 7300GT

[url="http://forums.macnn.com/82/applications/358297/why-am-i-getting-kp-instant/"]Why am I getting a KP the instant I launch DVD Player? - MacNN Forums[/url]

KP on x3100

 

and you and I both have a lot of RAM (over 3GB), and the 7600, which presumably is prone to the same issues as the 7300.

[KirbySaysHi]

UPDATE:: I tried using bc to calculate the square root of 2 to 1 million decimal places, and while it pinged one core of my processor to 100%, it didn't crash... but while it was going, I opened up photoshop, and started creating documents that were 1200dpi and 27in by 27in. One the second one, I got a kernel panic! It was the same kexts in the backtrace (the iokit stuff), and the current thread was Adobe Photoshop. Looking at the menu meter monitoring my ram, it looks like I had about 3000mb of memory left, which means that the panic occured with about 3000 used up... that 2.5gigs appears to be the magical number!

 

Wow. Amazing research work! This is very inspiring!

 

However, it's also a bit depressing, since it appears to be a bug in Leopard, and not the fact that we're using Hackintoshes. I can't tell if I'm actually depressed by that or extremely happy! (Since it means that perhaps Apple has to fix it in... 10.5.2!)

 

Here is my kernel panic, which occurred directly after the photoshop file shown was loaded (there was also a 512ram vm running windows XPSP2 running).

 

It appears to be exactly the same as you describe, except mine has to do with vmware. This is pretty typical for me: my current thread is either "vmware-vmx" or "smbd", which I take to be the samba daemon. All of this occurs when using a lot of ram.

 

The one thing I question about your research is if the 7600 is actually involved or not. Some of the posts on the blizzard forums (from the link you posted) seemed to have kernel panics involving NVDAResman.kext and such... which I don't think I've ever had.

 

One thing that has seemed to help a little bit in terms of the optical drive hangs and other file operation hangs is that I went into the bios and set "Onboard SATA/IDE Ctrl Mode" to IDE. It was set on sata from when I installed OS X (and I'm not sure what the default value is). It at least seems to help with the hangs on disk utility and such.

 

Also, it seemed that Time Machine was instigating a lot of these hangs as well... I'm not sure if it actually was or not, but it seemed like it. Thus, I disabled time machine for the... time... being. Are you running time machine, social swimmer?

 

The real question I have is, is this a Leopard thing, or a per-program problem? I think it definitely has to do with having more than 2.5 gigs of ram. I'm going to look into the getPhysicalSegment stuff for vmware, and see if anything crops up.

 

We COULD be making progress!

[Dense]

Why not try limiting the maximum memory to use 2GB which is under the limit of that function. Boot option to do so:

 

maxmem

Setting maxmem=N limits the available physical memory to N (in mega-bytes). N must be less than or equal to the actual amount of physical memory installed.

 

Then see if the system crashes.

 

The results would be extremely interesting.

[KirbySaysHi]

Well, I set my ram to 2gb, and it didn't panic. After 27 or so 1200 dpi photoshop documents open, bc computing the square root of 2 to 1 million decimal places, two virtual machines running (vista: 2gb, xp: 512), itunes playing a song, firefox, and oracle calendar, it decided to just plain old lock up. I could still move the mouse, but everything else was non-responsive. My menu meters showed about 240mb of ram left over... but they had frozen before the lock up.

 

So it seems to be the ram!

 

Could it possibly be the physical arrangement? With alternating dual-channel, my ram is set up as follows:

 

1gb 2gb 1gb 2gb

 

I wonder if I flipped the 1s and 2s around if anything would change... I don't have time to test it right now, though.

[Dense]

Grab the AppleVIAATA driver at http://www.opensource.apple.com/darwinsour...VIAATA-6.tar.gz

 

In the file AppleVIAATADriver.cpp you'll notice a reference to getPhysicalSegments. I'm no coder but is it possible this is what is causing the 2GB problem?

 

Even if this is not the reason, I would suspect AppleVIAATA since its the only old file reference in the kernel panic.

[socal swimmer]

Here is what I did:

 

I downloaded the kernel source, and altered "getPhysicalSegment" to call the corresponding 64 bit function when given a 64bit address. However, now it gives a page fault kernel panic. This means that something is calling a bad address. Which could be in AppleVIAATA.kext. I will look through that source soon and if I can fix something, I will do so and build it.

 

I will try limiting memory. thank you Dense!

 

where do you find all the different boot options? Is there a list somewhere (and I don't mean com.apple.Boot.plist)?

 

I doubt that changing the RAM config will alter anything.

 

Its interesting that we both have the same video card. I also read that there were kernel panics in Mac Pros with more than 2GB of memory, with the exact same error, when they had a geforce 7300, but not an ATI 2600. Maybe there is a problem with the nvidia drivers. Must dig deeper.

[LTL]

hey socal

 

I also have been seeing what it actually takes to crash my machine, sorry to join this thread at this late hour but I will post my findings here. Have my own install method which is based on retail CD with minimal file changes. My computer uses nearly 3.8GB of memory no problem... stable. I opened almost every program in Applications, Utilities, Office 2008, rocking itunes, then VMWARE (2GB x 1). still running smooth...200GB left, 3800 used. Only thing that froze it was using grab a second time, first time it worked.

 

ill get the SDK kit and see what i find...

 

I thought it was my 8800GT video card...i spoke to an Apple engineer about the card they use... it requires PCIs version 2, which is not available on our mobos. It is also already supported via 10.5.1. So I wonder if the 8800GT will actually work...but thats another thread

[physicallymac]

Very impressive thread. I have similar problem with kernel panics. After one panic I had to reinstall Kalyway because it would only loop the restart of my machine. I will try the 2GB memory boot option and report on findings. Thanks to all for the great information.

 

specs:

e-GeForce 7300 GS 256MB DDR2 PCI-E Video

Intel Core 2 Quad Q6600

Asus P5K P35 775 ATX

Maxtor Ultra 16 500GB 7,200RPM IDE ATA/133

Corsair Memory XMS2 4GB PC-6400 DDR2 Memory Kit

LinkSys Wireless-G PCI Adapter with SpeedBooster

[KirbySaysHi]

This is really intermittent.

 

I've got my maxmem set to 3456, and I still get kernel panics. I within the understanding that 3456mb was the 32-bit max; is it and 2gb that different in terms of how the kernel perceives it? However, if I try and max out my computer, it usually doesn't panic. The panic only happens when there is a sudden influx of disk activity. At least, that's when it seems to happen.

 

On another note: I also applied the solution at the end of this thread:

 

http://forum.osx86scene.com/viewtopic.php?f=3&t=2554

 

and it has definitely fixed the problem described (in that thread). No sign yet if it has helped with the panic situation.

 

Does anyone have any tests or trials I should run to report some data back? Especially Long Time Listener, what do you need from us to help?

[radov4n]

I thought it was my 8800GT video card...i spoke to an Apple engineer about the card they use... it requires PCIs version 2, which is not available on our mobos. It is also already supported via 10.5.1. So I wonder if the 8800GT will actually work...but thats another thread

I honestly don't think the problem is in 8800 GT or GTX. I haven't had a single graphics related crash for sure.

 

I also don't think there's a memory bug in leopard. I have 4 gig SR macbook and I haven't seen a single crash related to this on it; I use it every day and I am sure 've maxed memory multiple times.

 

This is a great thread, keep it up guys, I am sure there's gotta be a solution which we can come up with.

 

There's also a new 9.2 kernel with Kalyway 10.5.2 patch.. I haven't installed it yet, but maybe it will help?

[KirbySaysHi]

EDIT: I didn't see radov4n's post before I did this one... oops. Anywho, I'm running 10.5.2, and it didn't fix the issue. I believe (as I say below) that the issue is having 4gb of ram or more AND having the JMicron controller enabled.

 

So I've been reading around...

 

I'm pretty sure this issue is with the JMicron controller on our mother boards. I've read all over teh place that if you disable it in the bios, no more kernel panics! Apparently, the driver isn't fully 64 bit or something... and this is only an issue with 4gb of ram or more! I'm not actually using the JMicron sata ports, but my PATA port is also controlled by JMicron, apparently (where there are two critical hard disks connected).

 

Great.

 

Looks like I'm off to buy an ide pci card or something. Ugh.

[radov4n]

Well, I don't have it disabled, but I don't use the damn thing! Nothing is attached to it.. I also use 2GB... But I am using IDE mode. Very weird, but certainly possible. Have you had no crashes at all after you disabled it?

 

It could be hard to find an ide pci card, that's for sure. As they all make heavy use of BIOS.. I read that somewhere. Out of curiousity I tested my Adaptec 1200a pci ide raid card and it wasn't there. So you really need to find an mac / efi compatible card.. but then finding one for 10.5 could be a real {censored}. For this reason I put all my extra drives into a separate Vista x64 machine, which I use to run VMWare Ubuntu server (for web dev) and serve as a file server (via SMB).. so I don't have to keep all these drives in my hackintosh. I am also yet to find the damn decent sound card that would work with 10.5.. because listening to built in alc literally makes me cry.

 

Is this problem local to ICH9/ICH9R or does it occur on say ICH7/ICH7R? I know some P5W use jMicron too. I am tempted to get P5W and do some testing on it too...

 

Either way, thanks a lot for info; I'll give it a try.

Good luck!

 

PS. I also posted some info about my setup and GSODs here

http://forum.insanelymac.com/index.php?sho...;p=621443

It's relevant to this thread too.

[KirbySaysHi]

I haven't disabled my jmicron stuff, since I really need the data on those drives. Also, if I did disable it, I don't have any way that reliably causes a kernel panic, other than what I described here: http://forum.insanelymac.com/index.php?sho...id=623500

[socal swimmer]

So after reading this and other posts, I am going to unplug my IDE hard drive, and delete JMicronATA.kext. Maybe that will help?

 

It doesn't appear that all of the kexts responsible for the panic have source code available...

 

Also, I edited the kernel source to call the 64 bit function instead of crashing, but it gives page fault kernel panics instead. This means that something is calling a memory address that doesn't exist, in 64 bit or 32 bit. I don't know enough to be sure, but this points to another problem somewhere...