Written by me@grafxflow
15 Nov, 2020
74
40,802
WARNING ALERT: This ONLY relates to someone who has deleted the IOPlatformPluginFamily.kext in previous versions of macOS to sort the kernel_task overloading the CPU but now after installing macOS 11 (Big Sur) the problem has started again. You will be deleting a system extension and taking a risk... so you have been WARNED! + also best to use version 11.1 upwards, since when testing with 11.0.1 I found it very buggy!
So here is the problem...
After booting up the MacBook Pro the macOS would be running unbelievably slow. When opening the Activity Monitor to see what was happening with the CPU the thing at the top of the list was the kernel_task using around 500%!
In any of the previous versions - macOS 10.14 (Mojave) or below it was a fairly easy fix by first running recovery mode CMD + R and in the terminal.
csrutil disableThen running single user mode CMD + S.
fsck -fy
mount -uw /
sudo mkdir /IOPlatformPluginFamily-backup-kexts/
sudo mv /System/Library/Extensions/IOPlatformPluginFamily.kext /IOPlatformPluginFamily-backup-kexts/
sudo rm -rf /System/Library/Extensions/IOPlatformPluginFamily.kextBut from macOS 10.15 (Catalina) onwards this has stopped working. The reason being that Apple introduced the read-only system volume which is a dedicated partition for only storing system content which prevents any tampering with system files which one of them is the troublesome IOPlatformPluginFamily.kext.
Now before finding the solution below which relates to macOS 11 (Big Sur) I had tried making a bootable USB running macOS 10.14 (Mojave) but this couldn't read the read-only system volume.
Go to System Preferences -> Security & Privacy and choose the FileVault tab. Then select Turn Off FileVault.
SSV helps prevent tampering with any Apple software that is part of the operating system. Additionally, it makes macOS Software Update more reliable and much safer. SSV utilizes APFS snapshots, so if an update cannot be performed, the old system version can be restored without reinstallation.
So this means that macOS Big Sur actually no longer boots from the live system volume but now boots from a snapshot/copy of the same system folder. Normally it's impossible to mount a snapshot as writable, only readable so here is the solution I have found.
So at first bootup in Recovery Mode using CMD + R. On the screen that loads go to the navigation and choose Utilities -> Terminal. Input the following.
NOTE: Without this being done first you won't have permissions to carry out the next csrutil authenticated-root disable command.
csrutil disableThen.
rebootStraight away bootup in Recovery Mode again using CMD + R and choose Utilities -> Terminal. Input the following.
csrutil authenticated-root disableThen.
rebootNow reboot back into the normal macOS boot mode and let us mount the live volume - the disk1s5 could be different.
NOTE: To find out if 'disks5' is correct for your machine enter diskutil list in the terminal which will list your drives.
diskutil mount disk1s5Next make it writable which will require you to enter your password - the /Volumes/Macintosh\ HD\ 1 could be different.
sudo mount -uw /Volumes/Macintosh\ HD\ 1
Password:Now let's first see that the offending IOPlatformPluginFamily.kext file exists by entering.
ls -a /Volumes/Macintosh\ HD\ 1/System/Library/Extensions/Rather than deleting the file we will do a backup - so use the below and move it to a newly created folder.
sudo mkdir /Volumes/Macintosh\ HD\ 1/IOPlatformPluginFamily-backup-kexts/
sudo mv /Volumes/Macintosh\ HD\ 1/System/Library/Extensions/IOPlatformPluginFamily.kext /Volumes/Macintosh\ HD\ 1/IOPlatformPluginFamily-backup-kexts/Again see if it has disappeared from the directory.
ls -a /Volumes/Macintosh\ HD\ 1/System/Library/Extensions/Now we have deleted the file we need to add this new version of the system folder as a snapshot so enter the following.
sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs_systemsnapshot -s "SnapshotName" -v /Volumes/Macintosh\ HD\ 1Then tag this as a our default for the next reboot.
sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs_systemsnapshot -r "SnapshotName" -v /Volumes/Macintosh\ HD\ 1Now fingers crossed you should be able to reboot and the kernel_task should no longer be hogging the CPU as before and in return slowing your machine down.
30 Dec, 2018
13 Jan, 2019
22 Apr, 2020
I am a Full-stack Developer who also started delving into the world of UX/UI Design a few years back. I blog and tweet to hopefully share a little bit of knowledge that can help others around the web. Thanks for stopping by!
Follow
11 Jul, 2023
21 Jun, 2023
25 Nov, 2022
20 Sep, 2022
Views: 160,723
Views: 38,005
Views: 32,600
Views: 30,990
74 Response
John
16 Nov 2020Correct me if I'm wrong though :)
me@grafxflow
16 Nov 2020I was unaware of this, but yes it seems to be the case.
I have updated the content :)
Florian
16 Nov 2020sudo mv /Volumes/Macintosh\ HD\ 1/System/Library/Extensions/IOPlatformPluginFamily.kext /Volumes/Macintosh\ HD\ 1/IOPlatformPluginFamily-backup-kexts/
mv: rename /Volumes/Macintosh HD 1/System/Library/Extensions/IOPlatformPluginFamily.kext to /Volumes/Macintosh HD 1/IOPlatformPluginFamily-backup-kexts/IOPlatformPluginFamily.kext: Operation not permitted
What have I done wrong?
me@grafxflow
17 Nov 2020Have you tried the?
sudo mount -uw /Volumes/Macintosh\ HD\ 1
If not try the Recovery Mode using CMD + R and input.
csrutil disable
John
18 Nov 2020The loading bar crawls to the center as usual, stops for 4-5 minutes and then continues as usual. Once in macOS everything is fast and well, shutdown takes ages too.
Anyone with similar problems?
me@grafxflow
19 Nov 2020Yes I am noticing this to. It seems to hold 50% on the loading bar for a few minutes when starting up. Plus the fans are on full blast. Maybe see what happens with the next macOS update.
I also might need to look inside the laptop and see if cleaning it with some compressed air spray will sort the problem.
regards
Paul
Vi
19 Nov 2020me@grafxflow.co.uk
19 Nov 2020Try the following:
Go to System Preferences -> Security & Privacy.
Then select the FileVault tab and Turn Off FileVault.
Then one thing that is missing from the tutorial (Need to update it)
Bootup in Recovery Mode using CMD + R then enter
'csrutil disable'
'reboot'
Then start from 'Step 1 - Bypassing the Signed System Volume (SSV*)'
John
20 Nov 2020So if you're stuck at that, try recovery console - reinstall big sur et voilla :D
me@grafxflow
20 Nov 2020So just to confirm you suggest installing the macOS from Recovery Mode rather than the desktop?
And do you mean a reinstall or fresh install wiping the hard drive?
TheMalfunctioningSMC
01 Dec 2020me@grafxflow
01 Dec 2020Sadly not. I am beginning to think it maybe the actual macOS so will wait until there is an update.
TheMalfunctioningSMC
02 Dec 2020I followed all of your steps and it went through perfectly fine. Thanks for saving the day! Btw did you try John's suggestion of reinstalling Big Sur and "patching" the kexts again? What if macOS 15.2 releases, is it advisable to upgrade or will it break our patch? Does Activity Monitor itself take a high CPU % when open? Do you suggest any fan RPM app? I want to set it at 3500RPM
Sorry to bother you with so many questions. Thanks again!!
me@grafxflow
02 Dec 20201. I did try what John suggested but it still gave me the slow startup.
2. From my experience it mainly relates to new versions of macOS where this needs to be done again.
3. Activity Monitor itself should not cause any problems with the CPU usage.
4. You can use a fan app but still keep an eye on the temperatures.
TEO
08 Dec 2020Thanks
TEO
08 Dec 2020I solved by simply spacing .../MBPteo\ 1/... In this way. Now after having done as described in the guide (csrutil disable and csrutil root disable) still says "operation not permitted" trying now to perform those cmds again. I'll keep you up to date.
me@grafxflow
08 Dec 2020I will update the tutorial if required :)
TEO
08 Dec 2020Anie
20 Dec 2020me@grafxflow
20 Dec 2020It maybe an option to look at some youtube videos on cleaning the inside of your laptop. Using something like compressed air to clean the filters might help.
TEO
22 Dec 2020There is an IC near the SMC chip, which is responsabile of PROCHOT and THRMTRIP security temperature management. This is dangerous so make sure to properly manage the temperatures via Istats and mac fan control.
Alex
24 Dec 2020(Sorry, that's the only name I could find on the website :) )
Just wanted to say a HUGE thank you for this article!
I was struggling with lags ond freezes for the last several months, and despite of many trials and exhausting searches on the web. I'm so glad that you published this article, thank you so much!
Merry Christmas, and the best wishes to you and your family!
Happy Holidays!
Blake
15 Jan 2021Blake
15 Jan 2021Asrael
15 Jan 2021open: Resource busy
open failed on /dev/disk1s5
please tell me more about the command for apfs_systemsnapshot
Blake
17 Jan 2021Ipunchcorndogs
23 Jan 2021sudo: /system/library/filesystems/apfs.fs/contents/resources/apfs_systemsnapshot: command not found
me@grafxflow
23 Jan 2021I think there is a typo. Try the following instead.
sudo /system/library/filesystems/apfs.fs/contents/resources/apfs_systemsnapshot
Moe
27 Jan 2021Because i don’t have so much space on my HD haha
me@grafxflow
27 Jan 2021Sadly not because it's the snapshot you will be booting from every time.
Mir
31 Jan 2021I unlock this thing and it’s Stil grey :/
Grisha
01 Feb 2021me@grafxflow
01 Feb 2021I think the easiest option is to go back to stage 2.
csrutil authenticated-root enable
IPC
11 Feb 2021me@grafxflow
11 Feb 2021Yes the same should work for Catalina.
Voldemort
14 Feb 2021I have this problem on my MacBook Pro 16' after upgraded to Big Sur 11.2.1.
But I have not deleted the IOPlatformPluginFamily.kext in previous versions of macOS. Would this method also available for me?
me@grafxflow
14 Feb 2021Yes I am using the same Big Sur 11.2.1. Even with every Big Sur update I have to still do this.
I have never had to do this in the past but it all comes down to the new way the system folder is created in the newer MacOS's.
Voldemort
14 Feb 2021I'm going to try your method and would you tell me how to know which one I should mount if the disk1s5 and the /Volumes/Macintosh\ HD\ 1 is different from Step 3?
Thanks.
me@grafxflow
14 Feb 2021'disk1s5' may actually be the identifier/alias for '/Volumes/Macintosh\ HD\ 1'. So still use 'Volumes/Macintosh\ HD\ 1' but to find out - in the terminal enter the following.
diskutil list
Hope this helps. Also updated tutorial content.
Voldemort
15 Feb 2021I have done the steps but when "sudo mount -uw /Volumes/Macintosh\ HD\ 1" the output goes: unknown special file or file system. However the next stpes seems OK. I'm confused if I do the works well? Would you help me confirm it?
Sorry for my many questions. Thanks for your help!
https://imgur.com/9y6LTLF
https://imgur.com/tuGtDtC
https://imgur.com/DNWvyBT
Voldemort
15 Feb 2021Anyone with similar problem?
Steven C
13 Mar 2021I was able to compete the tutorial. My intent is to prevent the AppleIntelKBLGraphics.kext from loading which causing my screen flickering badly. Upon completed and restarted, how to confirm whether:
1) Big Sur is loaded from the new snapshot instead?
2) Sadly I can still see the AppleIntelKBLGraphics.kext being loaded from kextstat command. Strangely, it was removed from /System/Library/Extensions after reboot though.
3) Any method to reset back to original snapshot?
ET
17 May 2021I know I am sure you are tired of all the question but I would very much appreciate any help you could offer. Thanks!
Coco
19 May 2021Try the step 3 with "diskutil mount disk1s1" the localisation of Macintosh HD is perhaps different.
Nima
22 May 2021me@grafxflow
22 May 2021Sadly not :(
ET
24 May 2021Et
24 May 2021#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *500.3 GB disk0
1: EFI EFI 209.7 MB disk0s1
2: Apple_APFS Container disk1 500.1 GB disk0s2/dev/disk1 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +500.1 GB disk1 Physical Store disk0s2
Et
24 May 20212: APFS Volume Preboot 282.2 MB disk1s2
3: APFS Volume Recovery 622.1 MB disk1s3
4: APFS Volume VM 1.1 GB disk1s4
5: APFS Volume HD 15.3 GB disk1s5
6: APFS Snapshot com.apple.os.update-... 15.3 GB disk1s5s1
iom
27 May 2021me@grafxflow
27 May 2021Best to disconnect any external harddrives when doing this.
me@grafxflow
27 May 2021I have looked at the startup in verbose mode and it seems to hang on the x86PlatFormPlugin which is what has been deleted. So I need to look into this in more detail.
UPDATE: Sadly the best solution for me was to revert back to macOS Catalina
glx101
05 Jun 2021> 6 months running older OS high CPU usage has slowed system performance. Full stripdown service, clean and reinstall latest OS
yet the issue persists.
temps within normal range 24º-35ºC
STATUS:
Every time I try to boot into safe mode system hangs so I used a USB Boot for Mojave..
into safe mode csrutil disable - works fine
reboot into safe mode csrutil authenticated-root disable FAILS Every time invalid command "authenticated-root"
suggestions please?
me@grafxflow
05 Jun 2021csrutil authenticated-root disable is only required for 'Big Sur', and should only work in 'Recovery Mode'
I have gone back to using macOS Catalina.... which I know is a pain!
glx101
07 Jun 2021Ahhh ok so if I use a USB (mine wont boot into std recovery by itself) do I have to do anything else (different) to disable the csrauthenticated-root.
I had wondered if that might be causing me issues.
ET
28 Jun 2021Skarn
18 Jul 2021me@grafxflow
18 Jul 2021Just checking it is macOS 11 (Big Sur) you are running?
To me it sounds more like a severe hardware problem.
Skarn
18 Jul 2021Oly
23 Jul 2021Could you be knowing what is causing all this in the first place?
Eddie
04 Aug 2021donald
06 Oct 2021Yesterday I decided to reset NVRAM and SMC and I got a the computer started a rebooting loop.
Now I reinstalled the macos and did this again and everything is fine.
Johnny
18 Oct 2021Dmitriy
03 Nov 2021Josh
09 Feb 2022thib
07 Mar 2022when I try "sudo mount -uw /Volumes/Macintosh\ HD"
result:
mount: unknown special file or file system
and
ls /Volumes/Macintosh\ HD
result :
Applications Volumes etc sbin
Library bin home tmp
System cores opt usr
Users dev private var
thank you!
Zahid
05 Apr 2022what is the right syntax to get by step 3.
I am stuck on ,
mount: unknown special file or file system /Voumes/MacOS
me@grafxflow
05 Apr 2022I am guessing your volume name maybe different than the tutorial.
mikkmait
22 Apr 2022outtacontrol
06 May 2022Pascal
22 Jun 2022Peter
09 Sep 2022I have a few questions regaring step 3 .. .(and because of the 500 character limit, this comment comes in 3 parts)
I followed your guide, and I got no errors. After the last command of step 3 - listing the kexts again - the IOPlatformPluginFamily.kext was indeed gone. Hooray!
Mickey
27 Oct 2022Max
16 Aug 2023