8

I'm updating the driver of one of my devices and would like to kextunload the old driver and kextload the new one so a restart isn't required anymore.

After the installation I try:

sudo kextunload /System/Library/Extensions/Driver.kext

The error which happens looks like this:

(kernel) Can't unload kext com.driver.Driver; classes have instances: (kernel) Kext com.driver.Driver class com_driver_Driver_USBAudioDevice has 1 instance. Failed to unload com.driver.Driver - (libkern/kext) kext is in use or retained (cannot unload).

The device is not present in ioreg. How can I find out what this instance is which prevents me from unloading the driver?

2 Answers 2

12

If you call the command kextstat, it will display a list of all the loaded kernel extensions with info like this one:-

115 3 0xffffff7f814f4000 0x32000 0x32000 com.apple.iokit.IOAudioFamily (1.8.9fc11) <114 5 4 3 1>

The first number (115) is the id of the kernel extension.

At the end, the set of numbers <114 5 4 3 1> are the other kernel extension ids that are being referenced by this particular kext.

If you match the id of your kext to any of those listed in another, then that is a reference that kextunload is referring to.

Also note that when writing any code in the kernel, globals variables are global across the whole kernel, so if you've declared any that may not have a unique name and is used by another kext, I have found this to cause a similar issue. The solution here is to prepend any globals with a reverse company URI (e.g. com_apple_globalVarName).

6
  • So I need to unload all referenced kernel extensions as well.
    – Hedge
    Jun 27, 2013 at 14:18
  • From my experience, I would say you would need to do that, as I don't know of any other way to fix it. If you've made the mistake of global vars that aren't unique, I'd suggest simply resetting the machine as you're unlikely to know which other kext is causing the issue. Jun 27, 2013 at 14:25
  • 1
    It's not my driver and I also can't change it.
    – Hedge
    Jun 27, 2013 at 14:26
  • Ah, I thought it was as you'd labelled it "MyDriver.kext"! Jun 27, 2013 at 14:28
  • I changed that in the post to clear some confusion. Sorry about that.
    – Hedge
    Jun 27, 2013 at 14:29
4

The accepted answer is incorrect. The trailing numbers at the end of output from kextstat are NOT a listing of the kexts dependent on this one.

They ARE a list of the kexts that this kext is dependent upon.

Using the same example kext as the other answer, com.apple.iokit.IOAudioFamily, I show the following:

~ root# kmutil showloaded -b com.apple.iokit.IOAudioFamily
No variant specified, falling back to release
Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
  152    3 0xffffff7f9922c000 0x1e000    0x1e000    com.apple.iokit.IOAudioFamily (340.2) 2BC68A45-C1C1-30D1-A7A2-B911CFDB04F2 <151 7 6 3 1>

(Note: I am using kmutil showloaded instead of kextstat as the later is deprecated.)

Breaking this output down we see:

  • A Refs count of 3 indicates that 3 other kexts "refer" (or link against) this kext.
  • The <Linked Against> list indicates the Index of other kexts that this kext is dependent upon.

To specifically answer your question, you need to find the other kexts that have your kext's Index listed in their <Linked Against> listing.

Continuing our example with the com.apple.iokit.IOAudioFamily kext we can look at all loaded kexts and search for any referencing index 152 by running: kmutil showloaded | grep '<.*152.*>'

~ root# kmutil showloaded | grep '<.*152.*>'
No variant specified, falling back to release
  153    0 0xffffff7f99023000 0x52000    0x52000    com.apple.driver.AppleUSBAudio (416.2) D9A996CC-8118-3E85-B019-F756AC2A4689 <152 150 114 24 23 16 8 7 6 3 1>
  190    0 0xffffff7f97a97000 0x5f000    0x5f000    com.apple.driver.AppleGFXHDA (140.3) EED41AF8-3465-37CC-AB65-DB85BD71B595 <152 144 134 16 9 8 7 6 3 1>
  219    0 0xffffff7f990ad000 0x3000     0x3000     com.apple.driver.AudioAUUC (1.70) 5C4939F8-12C1-39BF-AD87-8456A450BCF7 <152 134 16 15 9 7 6 3 1>

As you can see, the three kexts that reference (or are Linked Against) com.apple.iokit.IOAudioFamily are:

  • com.apple.driver.AppleUSBAudio
  • com.apple.driver.AppleGFXHDA
  • com.apple.driver.AudioAUUC

You would need to unload these three kexts (and any kexts that they are referenced by in turn) before you could unload the original.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.