CODEWITHSUNDEEP
macosinstallationdriverkernel-extension
Hedge
Hedge

Reputation: 16768

Unload kext which still has instances

I'm updating the driver of one of my devices and would like to kextunload the old driver and kextload the new one so a restart isn't required anymore.

After the installation I try:

sudo kextunload /System/Library/Extensions/Driver.kext

The error which happens looks like this:

(kernel) Can't unload kext com.driver.Driver; classes have instances: (kernel) Kext com.driver.Driver class com_driver_Driver_USBAudioDevice has 1 instance. Failed to unload com.driver.Driver - (libkern/kext) kext is in use or retained (cannot unload).

The device is not present in ioreg. How can I find out what this instance is which prevents me from unloading the driver?

Upvotes: 9

Views: 23932

Answers (2)

Brett Lykins
Brett Lykins

Reputation: 151

The accepted answer is incorrect. The trailing numbers at the end of output from kextstat are NOT a listing of the kexts dependent on this one.

They ARE a list of the kexts that this kext is dependent upon.

Using the same example kext as the other answer, com.apple.iokit.IOAudioFamily, I show the following:

~ root# kmutil showloaded -b com.apple.iokit.IOAudioFamily
No variant specified, falling back to release
Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
  152    3 0xffffff7f9922c000 0x1e000    0x1e000    com.apple.iokit.IOAudioFamily (340.2) 2BC68A45-C1C1-30D1-A7A2-B911CFDB04F2 <151 7 6 3 1>

(Note: I am using kmutil showloaded instead of kextstat as the later is deprecated.)

Breaking this output down we see:

  • A Refs count of 3 indicates that 3 other kexts "refer" (or link against) this kext.
  • The <Linked Against> list indicates the Index of other kexts that this kext is dependent upon.

To specifically answer your question, you need to find the other kexts that have your kext's Index listed in their <Linked Against> listing.

Continuing our example with the com.apple.iokit.IOAudioFamily kext we can look at all loaded kexts and search for any referencing index 152 by running: kmutil showloaded | grep '<.*152.*>'

~ root# kmutil showloaded | grep '<.*152.*>'
No variant specified, falling back to release
  153    0 0xffffff7f99023000 0x52000    0x52000    com.apple.driver.AppleUSBAudio (416.2) D9A996CC-8118-3E85-B019-F756AC2A4689 <152 150 114 24 23 16 8 7 6 3 1>
  190    0 0xffffff7f97a97000 0x5f000    0x5f000    com.apple.driver.AppleGFXHDA (140.3) EED41AF8-3465-37CC-AB65-DB85BD71B595 <152 144 134 16 9 8 7 6 3 1>
  219    0 0xffffff7f990ad000 0x3000     0x3000     com.apple.driver.AudioAUUC (1.70) 5C4939F8-12C1-39BF-AD87-8456A450BCF7 <152 134 16 15 9 7 6 3 1>

As you can see, the three kexts that reference (or are Linked Against) com.apple.iokit.IOAudioFamily are:

  • com.apple.driver.AppleUSBAudio
  • com.apple.driver.AppleGFXHDA
  • com.apple.driver.AudioAUUC

You would need to unload these three kexts (and any kexts that they are referenced by in turn) before you could unload the original.

Upvotes: 5

TheDarkKnight
TheDarkKnight

Reputation: 27631

If you call the command kextstat, it will display a list of all the loaded kernel extensions with info like this one:-

115 3 0xffffff7f814f4000 0x32000 0x32000 com.apple.iokit.IOAudioFamily (1.8.9fc11) <114 5 4 3 1>

The first number (115) is the id of the kernel extension.

At the end, the set of numbers <114 5 4 3 1> are the other kernel extension ids that are being referenced by this particular kext.

If you match the id of your kext to any of those listed in another, then that is a reference that kextunload is referring to.

Also note that when writing any code in the kernel, globals variables are global across the whole kernel, so if you've declared any that may not have a unique name and is used by another kext, I have found this to cause a similar issue. The solution here is to prepend any globals with a reverse company URI (e.g. com_apple_globalVarName).

Upvotes: 12

Related Questions