jump to navigation

Trouble shooting kernel panics June 21, 2006

Posted by farshadf in Uncategorized.

Only for adnvaced user who understand unix 

About the Kernel and Extensions

Mac OS X's kernel is based on the Mach kernel and is called XNU. The kernel is responsible for Mac OS X's pre-emptive multitasking, virtual memory, protected memory, basic I/O, and such like. It controls all other running processes, confining them to their own 'cell' so they cannot interfere with each other or with the kernel itself. This confinement is what gives Mac OS X a lot of its stability – an errant process cannot make waves throughout the whole system.

Normal processes run with the processor (PowerPC) in an unprivileged mode: this is the mechanism by which they are confined to their individual cells. They are not allowed direct access to the machine hardware.

The kernel runs in privileged mode and has full access to the hardware – memory, disc drives, peripherals, etc. If the kernel crashes then everything goes down. A stable kernel gives Mac OS X stability.

Most instability is caused by device drivers. Device drivers need access to the hardware, and so need to run in privileged mode. They are therefore implemented as extensions to the kernel, also known as kernel extensions or .kext files, and run in 'kernel space'.

Kernel extensions can be divided into those supplied by Apple as part of Mac OS X, and third party extensions usually installed when additional hardware is added. Both types can be found in the folder System:Library:Extensions. Most instability lies in third party extensions.

When the kernel, or a device driver crashes, you experience what is called a Kernel Panic. This can be recognised by:

– a white box of text in many language set on a dimmed screen
– complete unresponsiveness of the machine

A Kernel Panic may happen very occasionally, say one or twice a year. If it happens regularly, suspect any newly-installed device drivers.

Trouble-Shooting Steps

Boot with only Apple-supplied extensions. Restart you Mac with the space bar held down to perform a 'safe boot'. This skips non-Apple startup items too.

If safe boot works, uninstall recently-installed third party drivers. If there are no uninstall instructions, then locate the suspect extension (/System/Library/Extensions), temporarily remove it, and reboot.

Use the Terminal to delete the files /mach and /mach.sym. You will need root permissions to do this. Normally these are deleted and re-built automatically each time the machine is booted.

If the machine is very slow at booting or running, remove the extension cache files:


These will be re-built when the machine is rebooted.



No comments yet — be the first.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: