Get base address and size of a loaded kernel module?

Question

How can I get the base address and size of a loaded kernel module?

score 4 · Answer 1 · answered Apr 05 '15 at 00:53

I think you can use /proc/modules. It contains information about all currently loaded modules in the kernel. For example:

cat /proc/modules | grep i8k

Result could be:

i8k 14696 0 - Live 0xffffffffa03b8000

Where:

The first column contains the name of the module.
The second column refers to the memory size of the module, in bytes.
The third column lists how many instances of the module are currently loaded. A value of zero represents an unloaded module.
The fourth column states if the module depends upon another module to be present in order to function, and lists those other modules.
The fifth column lists what load state the module is in: Live, Loading, or Unloading.
Base memory address for a module in the kernel's virtual address space.

If you run:

awk '$1 ~ /i8k/ { print $1, $2, $6 }' /proc/modules

The result could be, values you need:

i8k 14696 0xffffffffa03b8000

I had to run sudo cat /proc/modules in order to see the base addresses (6) — philn, Jun 09 '20 at 17:58
The 3rd column is actually a reference count, it has nothing to do with how many instances are loaded (I doubt a module can have multiple instances anyway, even when handling multiple devices). A value of 0 means the module can be unloaded and a non-zero value means it cannot (references to it must be released first, most likely by other modules). — Tey', Apr 15 '21 at 19:18

score 2 · Answer 2 · edited Apr 16 '18 at 15:59

2

Size on /sys

I like this alternative as it gives just a single value:

cat /sys/module/<module-name>/coresize

Load address on pr_debug

If you enable pr_debug, that information is present, and this can be useful if the module panics at init_module.

edited Apr 16 '18 at 15:59

answered Apr 14 '18 at 21:39

2 Answers2