GNU/Linux - 如何使用lsmod和modinfo命令

How to Use the lsmod and modinfo Commands in Linux

Linux 内核是模块化的，这意味着可以根据需要添加和删除模块。这就造就了一个轻量级、安全和轻便的内核。它的灵活性让你可以添加和删除你需要的功能，使操作系统符合你的使用情况和偏好。

The Linux kernel is modular in nature, which means it’s possible to add and remove modules as needed. This makes for a secure and lightweight kernel. Its flexibility enables you to add and remove the features you need to make an operating system fit your use case and preferences.

检查 Linux 系统的内核模块非常重要，尤其是在排除硬件或软件安装故障时。例如，如果特定硬件或软件的内核模块没有加载，你可能会遇到问题。在这种情况下，你可以使用 lsmod 命令查看 Linux 系统上的可用模块。如果模块已加载，你可以列出模块的详细信息，进一步排除故障。这可以使用 modinfo 命令来实现。本教程将向你展示如何使用 lsmod 和 modinfo 命令来检查 Linux 系统的内核模块。

It is important to inspect a Linux system’s kernel modules, especially when troubleshooting a hardware or software installation. For example, you may encounter an issue if a kernel module for a specific piece of hardware or software has not loaded. In this scenario, you use the lsmod command to view the available modules on your Linux system. If a module is loaded, you can further troubleshoot by listing out the details of the module. This is achieved using the modinfo command. This tutorial shows you how to use the lsmod and modinfo commands to inspect your Linux system’s kernel modules.

What are Linux Kernel Modules (LKM)?

Linux 内核模块是可以根据需要从 Linux 内核中添加或删除的代码片段。内核模块通常能启用某些硬件或系统功能。有些模块直接内置在内核中，无法删除。而可加载模块则可以添加和删除，无需重启 Linux 系统。

Linux kernel modules are pieces of code that can be added to or removed from the Linux Kernel as required. Kernel modules often enable certain hardware or system features. Some modules are built directly into the kernel and cannot be removed. Loadable modules, on the other hand, can be added and removed without having to reboot your Linux system.

可加载的内核模块允许你扩展系统的功能。如果没有模块，Linux 将不得不依赖全包含式内核，而全包含式内核的灵活性和安全性都会大打折扣。全包含式内核的另一个问题是，当需要新功能时，必须将其直接内置到内核映像中。这意味着内核不仅体积更大，而且构建时间更长。使用全包含式内核，每次添加新功能时，系统都必须重新启动。

Loadable kernel modules allow you to extend the functionality of your system. Without modules, Linux would have to depend on a monolithic kernel which isn’t nearly as agile and secure. Another issue with a monolithic kernel is when new functionality is needed it must be built directly into the kernel image. This means the kernel is not only larger, but takes considerably longer to build. With monolithic kernels, every time new functionality is added, a system has to be rebooted.

Linux 内核模块全部存储在 /lib/modules 目录中。将内核模块集中存放在本地目录中，可以提高加载和卸载内核模块的效率。如果检查/lib/modules目录，你可以找到系统上安装的每个内核的子目录。例如，你的 Linux 服务器可能会显示以下已安装的内核：（以我的Ubuntu 22.04为例）

$ ls /lib/modules/

6.2.0-26-generic 6.5.0-21-generic 6.5.0-26-generic 6.5.0-28-generic

6.2.0-34-generic 6.5.0-25-generic 6.5.0-27-generic

$ ls /lib/modules/6.5.0-28-generic/

build modules.alias.bin modules.builtin.modinfo modules.order vdso

initrd modules.builtin modules.dep modules.softdep

kernel modules.builtin.alias.bin modules.dep.bin modules.symbols

modules.alias modules.builtin.bin modules.devname modules.symbols.bin

Linux Kernel Modules are all stored in the /lib/modules directory. By keeping kernel modules housed in a centralized, local directory, it is more efficient to load and unload kernel modules. If you inspect the /lib/modules directory, you can find subdirectories for every kernel that has been installed on your system. For example, your Linux server might display the following installed kernels:

如果你查看某一个内核目录的内容，就可以看到相关的模块文件。

If you view the contents of one the kernel directory stored in the 4.19.0-18-amd64 directory, for example, you can view module files related to your system.

List Kernel Modules with lsmod

lsmod 命令是 "list modules"的缩写，它列出了系统中所有已加载的内核模块。在终端上使用 lsmod 命令列出系统的所有内核模块。

$ lsmod

The lsmod command stands for “list modules,” and lists out every loaded kernel module on a system. From a terminal, use the lsmod command to list all of your system’s kernel modules.

该命令的输出可能很长，分三列显示：

Module - 模块名称。
Size - 模块的大小（以字节为单位）。
Used by - 有多少个模块实例正在使用以及哪个系统正在使用该模块。

下面的示例显示了当你发出 lsmod 命令时系统可能返回的结果。输出会显示加载的每个模块及相关详细信息。

$ lsmod

Module Size Used by

xt_conntrack 12288 1

nft_chain_nat 12288 3

xt_MASQUERADE 16384 1

nf_nat 61440 2 nft_chain_nat,xt_MASQUERADE

nf_conntrack_netlink 57344 0

nf_conntrack 208896 4 xt_conntrack,nf_nat,nf_conntrack_netlink,xt_MASQUERADE

nf_defrag_ipv6 24576 1 nf_conntrack

nf_defrag_ipv4 12288 1 nf_conntrack

...

The output of the command can be very long and displays the output in three columns:

* Module - the name of the module.

* Size - the size of the module in bytes.

* Used by - how many instances of the module are in use and what system is using the module.

The example below displays what a system might return when you issue the lsmod command. The output displays every module that is loaded and the associated details.

一个模块可以有多个实例被同一个子系统使用。

Display Information About a Linux Kernel Module with modinfo

使用 modinfo 命令可以获取有关特定内核模块的更多信息。继续上面的例子，你可以使用以下命令查看有关 nfnetlink 模块的更多信息：

You can uncover even more information about a specific kernel module using the modinfo command. Continuing with the example above, you can view more information about the nfnetlink module, with the following command:

输出显示信息如下：

The output for the modinfo nfnetlink command displays the following information.

$ modinfo nfnetlink

filename: /lib/modules/6.5.0-28-generic/kernel/net/netfilter/nfnetlink.ko

description: Netfilter messages via netlink socket

alias: net-pf-16-proto-12

author: Harald Welte <laforge@netfilter.org>

license: GPL

srcversion: F288615435849546E2E38A4

depends:

retpoline: Y

intree: Y

name: nfnetlink

vermagic: 6.5.0-28-generic SMP preempt mod_unload modversions

sig_id: PKCS#7

signer: Build time autogenerated kernel key

sig_key: 0B:58:66:1F:8F:66:CD:90:C5:95:EC:65:01:8E:89:E3:D4:9A:26:80

sig_hashalgo: sha512

signature:

4A:85:FD:8F:F5:8D:FA:1E:5E:1C:81:AD:C7:1A:AE:4A:BB:1D:B3:D2:

F1:AB:33:C7:54:85:42:5D:A5:61:C7:4C:DC:C5:82:E5:9C:5D:1B:56:

96:19:23:2D:E4:11:A3:56:11:9C:1A:45:53:5D:76:25:12:09:2D:F4:

19:2F:AA:EE:8E:25:80:75:90:63:F5:D2:6B:F2:39:8C:97:96:DD:73:

A3:C0:18:27:54:79:86:D6:0F:99:99:88:5C:12:3A:1F:6C:47:AD:03:

B7:76:06:54:34:6D:E6:86:EB:81:A8:86:78:EE:BF:B5:ED:76:71:D0:

E4:30:B6:DD:09:01:94:0C:9B:E6:9C:8B:91:20:CD:AF:9F:84:9F:58:

BA:49:5A:0F:BA:0A:B6:BA:57:D5:C6:8A:16:C2:51:D6:E3:71:D4:4F:

3D:DD:41:2F:31:90:EF:1C:69:DA:8B:AA:A2:44:8D:3C:7C:2E:9D:A8:

9A:2C:1B:38:35:AF:57:95:2E:3D:A8:60:9A:9E:65:CC:46:8C:E5:CA:

0E:E5:39:9A:DF:7A:6E:F2:8B:41:A5:17:E9:E6:6F:09:53:FC:C7:7E:

37:80:69:11:77:6F:D4:0D:AB:BC:01:A9:9C:0F:A2:C8:D4:85:41:18:

B5:BB:48:85:A3:66:FD:CF:F0:77:53:67:AD:48:1E:E6:77:88:62:14:

1B:D4:31:25:6A:2B:A2:32:A7:03:A7:69:F1:97:0D:5B:A4:61:B2:98:

44:E8:4C:29:18:35:7B:D5:AD:48:4A:44:80:C7:0F:63:17:8A:7E:72:

BF:D0:8F:17:24:54:79:85:60:72:28:24:CE:34:E0:2E:6B:1C:17:9A:

94:D0:FC:8A:D8:5F:7B:9C:85:F4:1C:D6:AB:92:B8:3F:CF:D1:C0:F3:

B1:F9:41:99:42:20:99:1E:11:6B:04:54:FD:45:9B:15:8F:E0:9E:1C:

80:2D:E4:80:39:35:09:87:29:58:95:E0:F4:AF:A8:D3:F0:97:A2:1A:

B9:AB:95:58:C8:5A:9A:E9:02:32:E9:1D:96:FB:05:9B:34:7D:0D:7B:

4F:97:7F:B6:D4:2E:39:32:BC:61:5D:C6:2A:84:F2:11:93:D1:62:27:

7D:C2:AD:74:C4:D1:8C:75:38:C5:0E:06:98:DB:C1:9C:F3:5A:54:47:

58:42:82:EB:45:93:CD:DE:95:5A:52:F8:0A:6A:87:08:0A:7A:23:AC:

E8:10:D7:D9:B6:47:F8:51:0F:68:8C:CC:D4:DB:44:8F:97:16:31:17:

6B:2B:A5:EB:CB:2A:FF:9B:03:59:AB:F4:96:66:7B:D6:F0:E8:68:55:

0C:59:57:27:D2:72:CD:CE:9B:F8:5D:BE

输出内容包括：

filename - 模块所在的具体路径
alias - 内核中使用的模块别名。
author - 模块的作者。
license - 模块许可证。
srcversion - 模块源代码的具体版本。
depends - 模块的任何依赖关系。
retpoline - 模块是否启用了 retpoline。
intree - 如果模块在内核 Git 仓库中维护
name - 模块名称。
vermagic - 内核模块的版本。
sig_id、signer、sig_key、sig_hashalgo 和 signature - 显示模块的密钥签名信息。

The output includes:

* filename - the specific path housing the module (in this case, /lib/modules/6.5.0-28-generic/kernel/net/netfilter/nfnetlink.ko).

* alias - the module alias used within the kernel.

* author - the author of the module.

* license - the module license.

* srcversion - the specific version of the module source.

* depends - any dependencies a module might have.

* retpoline - if the module is retpoline enabled.

* intree - if the module is maintained in the kernel Git repository

* name - the name of the module.

* vermagic - the version of the kernel module.

* sig_id, signer, sig_key, sig_hashalgo, and signature - all display information about the module’s key signature.

如果 modinfo nfnetlink 命令显示的信息过多，无法满足您的需要，您可以使用 --field 选项指定希望显示的字段。例如，如果只需要查看文件名字段，请执行以下命令：

$ modinfo --field filename nfnetlink

If the modinfo nfnetlink command displays too much information for your needs, you can specify which field you want to be displayed using the --field option. For example, if you only need to view the filename field, issue the following command:

默认情况下，modinfo 会列出当前运行内核所使用模块的信息。您也可以查找特定内核模块的信息，但您的系统上可能没有运行该模块。例如，你可能想要了解上一个内核中 nfnetlink 模块的信息。为此，请执行以下命令：

$ modinfo -k 6.5.0-26-generic nfnetlink

By default, modinfo lists information for modules used by the current running kernel. You can also find information about a module for a specific kernel that may not be running on your system. Perhaps you want information about the nfnetlink module from the previous kernel. To do so, issue the following command:

上述命令的输出只列出 6.5.0-26-generic 内核模块的信息，而不是当前运行内核的信息。

The output for the above command only lists information for the module from the 6.5.0-26-generic kernel, instead of the currently running kernel.

Conclusion 总结

每当你需要特定 Linux 内核模块的信息时，lsmod 和 modinfo 都是你可以依赖的命令。结合使用 lsmod 和 modinfo，你可以收集到每个可用模块的大量详细信息。如果你想了解更多有关管理 Linux 内核的信息，请查看我们的 Linode 内核管理指南： https://www.linode.com/docs/products/compute/compute-instances/guides/manage-the-kernel/。

Whenever you need information about a particular Linux kernel module, lsmod and modinfo are commands you can rely on. Using the combination of lsmod and modinfo, you can gather plenty of details for each available module. If you’re looking for more information on managing your Linux kernel, check out our Managing the Kernel on a Linode guide.

参考：

https://www.linode.com/docs/guides/lsmod-and-modinfo-commands-in-linux/