query_module(2)

💖 query_module(2) — the (very much retired) module-querying syscall

okay bestie, sit down, hydrate, and let's talk about query_module from the System Calls Manual. This one is giving vintage, because she is not around anymore — but the lore is worth knowing. 🎀

---

✨ NAME ✨

query_module — query the kernel for various bits pertaining to modules

Like, the kernel has loadable modules, right? And back in the day you could just… ask the kernel about them. That's the whole vibe. 👑

---

🌸 SYNOPSIS 🌸

#include <linux/module.h>

[[deprecated]] int query_module(size_t bufsize;
                                const char *name, int which,
                                void buf[bufsize], size_t bufsize,
                                size_t *ret);

yeah she's marked [[deprecated]], no cap. the compiler is side-eyeing you. 💀

---

🦋 DESCRIPTION 🦋

Note: This system call is present only before Linux 2.6. So if you're on literally any modern kernel, she's gone, bestie, she's at the club in the sky. 😭

query_module() requests information from the kernel about loadable modules. The returned info gets dropped into the buffer that buf points at. You, the caller, must tell her how big buf is via bufsize (yes, the header is chaotic and mentions it twice, and no, we don't ask questions, we just copy the interface faithfully 🙈). The exact nature and format of what comes back depends on the operation you pick with which. Some operations need name to identify a currently loaded module; others are fine with name being NULL, which means "the kernel proper." 🧚

Here's every value you can pass for which, and what each one does:

• 0 — Returns success if the kernel supports query_module(). This is the probe move: you use it to check whether the system call even exists. Vibe check the syscall, basically. 💅
• QM_MODULES — Returns the names of all loaded modules. The returned buffer is a sequence of null-terminated strings; ret is set to the number of modules. It's a whole guest list. ✨
• QM_DEPS — Returns the names of all modules used by the indicated module. The returned buffer is a sequence of null-terminated strings; ret is set to the number of modules.
• QM_REFS — Returns the names of all modules using the indicated module. This is the inverse of QM_DEPS. The returned buffer is a sequence of null-terminated strings; ret is set to the number of modules. It's giving "who's in your mentions." 👀
• QM_SYMBOLS — Returns the symbols and values exported by the kernel or the indicated module. The returned buffer is an array of structures that look exactly like this:

struct module_symbol {
    unsigned long value;
    unsigned long name;
};

followed by null-terminated strings. The value of name is the character offset of the string relative to the start of buf; ret is set to the number of symbols. 🍓

• QM_INFO — Returns miscellaneous information about the indicated module. The output buffer format is:

struct module_info {
    unsigned long address;
    unsigned long size;
    unsigned long flags;
};

where address is the kernel address at which the module resides, size is the size of the module in bytes, and flags is a mask of MOD_RUNNING, MOD_AUTOCLEAN, and so on, that indicates the current status of the module (see the Linux kernel source file include/linux/module.h). ret is set to the size of the module_info structure. Iconic little info dump. 👑

---

🌈 RETURN VALUE 🌈

On success, zero is returned. Slay. On error, -1 is returned and errno is set to indicate the error. 😭

---

💜 ERRORS 💜

• EFAULT — At least one of name, buf, or ret was outside the program's accessible address space. Like, babe, that memory isn't yours.
• EINVAL — Invalid which; or name is NULL (indicating "the kernel"), but this is not permitted with the specified value of which. Wrong order, wrong combo, denied. 💅
• ENOENT — No module by that name exists. She's not here, girl, never was.
• ENOSPC — The buffer size provided was too small. ret is set to the minimum size needed. So at least you get a hint! 🫶
• ENOSYS — query_module() is not supported in this version of the kernel (e.g., Linux 2.6 or later). The "she's literally not here anymore" error. 💀

---

⭐ STANDARDS ⭐

Linux. That's it. That's the standard. ✨

---

💅 VERSIONS 💅

Removed in Linux 2.6. Gone. Retired. Archived. 🎀

Some of the information that was formerly available via query_module() can be obtained from /proc/modules, /proc/kallsyms, and the files under the directory /sys/module. So the lore lives on in other places, bestie. 🌸

The query_module() system call is not supported by glibc. No declaration is provided in glibc headers, but, through a quirk of history, glibc does export an ABI for this system call. So in order to employ this system call, it is sufficient to manually declare the interface in your code; alternatively, you can invoke the system call using syscall(2). Not glibc giving ABI for a syscall she refuses to declare — the audacity, the mystery, the history. 😭

---

🔥 SEE ALSO 🔥

• create_module(2)
• delete_module(2)
• get_kernel_syms(2)
• init_module(2)
• lsmod(8)
• modinfo(8)

---

heads up: she's deprecated and gone after Linux 2.6, so if you're reaching for her on a modern box you're gonna get ENOSYS and a little heartbreak. 💔

kk that's the whole page, bestie. This little artifact came to you straight from Linux man-pages 6.20, dated 2025-09-07 💖✨ keep her in your heart, or better yet, in your /proc and /sys reading habits. mwah 🫶