Random Shutdown in Big Sur (ThunderboltNHI) driver problem

App & System Services Core OS
redmetz OP
Created Nov ’20
Replies 66
Boosts 0
Views 37k
Participants 54
Hey guys,
I have the problem that my 2013 MacBook crashes frequently since upgrading to Big Sur. This means that all of a sudden the screen freezes, the fans turn up and all of a sudden the MacBook is off. In Catalina, through research I found out that it's because of the Thunderbolt driver (AppleThunderboltNHI.Kext etc.), which I had always renamed in Catalina using recovery mode (... .kext.BAK). This solved the problem. But now since Big Sur I can't rename the Kext files anymore because I'm only in read-only mode. So I wanted to ask here if there is a possibility to rename the files again? Otherwise the MacBook still runs really well!

Replies  66
Boosts  0
Views  37k
Participants  54
rlf613 OP
Nov ’20
I have managed to rename/delete the NHI.kext file but it's useless because in Big Sur the kext is cached into the preboot process so it's still loaded in memory and causing crashes. Unfortunately you can't unload it and until someone tells me how to remove it from the boot kernel collection we're stuffed.
2
lrlazarov OP
Nov ’20
Following this thread.
0
sokzrabarbaru OP
Nov ’20
Same problem...
0
sy158 OP
Nov ’20
Same, following
0
KaiThePirate OP
Nov ’20
I was able to rename/move/delete the .kext file as well, but it's now part of the kernel and until Apple gets off their tails and does something about it, Big Sur is useless to myself (mid-2014 MBP) and others that are having an issue that has been around for 3-4 major OS revisions.
1
lfw3862067 OP
Nov ’20
same here... died for a few times on first day of Big Sur, exhausted. ..look forward to solutions
1
sf98723 OP
Nov ’20
"Solved"

Found how to remove the thunderbolt driver in Big Sur this morning.

In Catalina, deleted drivers were not loaded by the kernel at boot after having deleted/moved/renamed the kext directory.

In Big Sur,

  • The driver remains in the extensions cache, this one must be rebuilt with kmutil

  • You must "deactivate the seal" and make another snapshot after the cache has been rebuilt.

Follow this procedure :

  1. Reboot in rescue mode (reboot while "Cmd + R")

  2. csrutil disable

  3. csrutil authenticated-root disable

  4. reboot in rescue mode

  5. mount -uw /Volumes/[MacOS <your custom stuff here>]

  6. delete (or rename, or move elsewhere) the AppleThunderboltNHI.kext directory (I've moved all thunderbolt kext directories since I have no needs about this interface, but I think it works only by disabling AppleThunderboltNHI)

  7. REBUILD the extensions cache ! (new has-to-do in Big Sur...) : kmutil install -u --force --volume-root /Volumes/[MacOS <your custom stuff here>]

  8. DON'T FORGET to create another system snapshot to take these modifications under account at next reboot : bless --folder /Volumes/[MacOS <your custom stuff here>]/System/Library/CoreServices --bootefi --create-snapshot

  9. csrutil enable (mays be you have to reboot in rescue mode.. not tested)

Finally, reboot in normal mode : you can check kextstat : it shows that the driver is actually not loaded :)


It works for my MacBook Pro mid 2014..

Either a hardware problem when using the driver of the host interface, either a bug. Apple did not communicate, I think it's a hardware issue..

7
Tom35000 OP
Nov ’20
How can I make the « csrutil authenticated-root disable » command when it tells me to disable FileVault ? How do I disable FileVault from rescue mode ?

0
sf98723 OP
Nov ’20
Hmm, I do not encrypt my Mac.

I think if you want to encrypt, you have to disable FileVault in system preferences, follow the procedure, and then enable FileVault.

Remember : you have to do that at each big sur update..
Unless Apple fix this bug or you buy a new Mac (M1 ...)


0
Tom35000 OP
Nov ’20
i Can’t disable filevault in system preference because my mac shut down 1 minute after reboot ...
0
sf98723 OP
Nov ’20
This shutdown occurs when the Mac seems to use the discrete graphics, and is hot.

I had yesterday to invoke 'kmutil invoke-panic-medic' to disable all third party pbs, and check the integrated graphics was used (kill chromium etc..)

So : in recovery mode, kmutil invoke-panic-medic, ensure your integrated graphics is used rather than nividia, you should have enough time then to disable FileVault
1
sf98723 OP
Nov ’20
It sucks...
2
rlf613 OP
Nov ’20
I can confirm the solution posted by sf98723 works!

Do exactly as they say. Thank you so much.

Just a FWIW. I don't believe it has anything to do with the graphics. It's a faulty chip in the 2013-2015 MBP that is interacting with the NHI.kext file to cause the CPU to shutdown.

More details here: https:// outluch.wixsite.com/rmbp-crash
2
Tom35000 OP
Nov ’20
Can’t disable FileVault, my mid-2014 MacBook Pro shut down in 1-2 minutes and nothing help to increase the time within the Mac reboot itself
0
rlf613 OP
Nov ’20
Tom if you know a bit about Python you can delay the shutdowns by forcing constant CPU wake-ups

As soon as you login, go to to terminal type 'python'


Code Block 
import time
while True:
	time.sleep(0.00002) (press tab on this line first)


Press enter twice. And then disable FileVault straight away

If your computer is really shutting down so fast you you can't disable FileVault try plugging in all kind of devices, like an external monitor, USB mouse/keyboard/hard-drive and Thunderbolt/USB ethernet. I found that helps sometimes.




1
Random Shutdown in Big Sur (ThunderboltNHI) driver problem
First post date Last post date
 
 
Q