openEuler/龙蜥OS：不同内核版本的驱动模块可以交叉加载吗？
1. 安装openEuler
- 虚拟机未开启 Secure Boot
- 版本：openEuler-22.03-LTS-SP3
- 内核：5.10.0-182.0.0.95.oe2203sp3.x86_64（默认内核）
[root@localhost ~]# uname -r
5.10.0-182.0.0.95.oe2203sp3.x86_64
2. 安装不同版本的内核
- 搜索不同内核版本 yum serach --showduplicates kernel
[root@localhost ~]# yum search --showduplicates kernel | grep kernel-5.10
Last metadata expiration check: 0:51:08 ago on Mon 17 Feb 2025 10:05:11 AM CST.
kernel-5.10.0-182.0.0.95.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-182.0.0.95.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-182.0.0.95.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-182.0.0.95.oe2203sp3.src : Linux Kernel
kernel-5.10.0-183.0.0.96.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-184.0.0.97.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-185.0.0.98.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-186.0.0.99.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-187.0.0.100.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-188.0.0.101.oe2203sp3.x86_64 : Linux Kernel
kernel-5.10.0-189.0.0.102.oe2203sp3.x86_64 : Linux Kernel
...省略...
- 安装不同版本的内核
- 选择 kernel-5.10.0-183.0.0.96.oe2203sp3.x86_64
[root@localhost ~]# yum install kernel-5.10.0-183.0.0.96.oe2203sp3.x86_64
3. 选择实验用的驱动模块
- 列出所有当前加载的模块
[root@localhost ~]# lsmod
Module Size Used by
vfat 20480 0
btrfs 1679360 0
xor 24576 1 btrfs
raid6_pq 122880 1 btrfs
ntfs 122880 0
msdos 20480 0
fat 86016 2 msdos,vfat
xfs 1847296 0
nft_ct 24576 0
nft_chain_nat 16384 0
nf_nat 57344 1 nft_chain_nat
nf_conntrack 180224 2 nf_nat,nft_ct
nf_defrag_ipv6 24576 1 nf_conntrack
nf_defrag_ipv4 16384 1 nf_conntrack
ip_set 61440 0
rfkill 32768 0
nf_tables 278528 2 nft_ct,nft_chain_nat
libcrc32c 16384 5 nf_conntrack,nf_nat,btrfs,nf_tables,xfs
nfnetlink 20480 2 nf_tables,ip_set
vmwgfx 393216 1
ttm 118784 1 vmwgfx
snd_ens1371 36864 0
snd_ac97_codec 184320 1 snd_ens1371
intel_rapl_msr 20480 0
intel_rapl_common 32768 1 intel_rapl_msr
ac97_bus 16384 1 snd_ac97_codec
snd_rawmidi 45056 1 snd_ens1371
snd_seq_device 16384 1 snd_rawmidi
isst_if_mbox_msr 20480 0
snd_pcm 139264 2 snd_ac97_codec,snd_ens1371
isst_if_common 20480 1 isst_if_mbox_msr
drm_kms_helper 286720 1 vmwgfx
nfit 81920 0
snd_timer 49152 1 snd_pcm
libnvdimm 221184 1 nfit
snd 114688 6 snd_seq_device,snd_timer,snd_ac97_codec,snd_pcm,snd_rawmidi,snd_ens1371
vmw_balloon 28672 0
sg 45056 0
syscopyarea 16384 1 drm_kms_helper
sysfillrect 16384 1 drm_kms_helper
sysimgblt 16384 1 drm_kms_helper
rapl 24576 0
fb_sys_fops 16384 1 drm_kms_helper
joydev 28672 0
pcspkr 16384 0
soundcore 16384 1 snd
cec 53248 1 drm_kms_helper
vmw_vmci 94208 1 vmw_balloon
i2c_piix4 28672 0
drm 638976 4 vmwgfx,drm_kms_helper,ttm
fuse 180224 1
ext4 983040 2
mbcache 16384 1 ext4
jbd2 167936 1 ext4
sr_mod 28672 0
cdrom 86016 1 sr_mod
ata_generic 16384 0
crct10dif_pclmul 16384 1
crc32_pclmul 16384 0
ata_piix 40960 0
crc32c_intel 24576 5
nvme 49152 2
libata 307200 2 ata_piix,ata_generic
vmxnet3 69632 0
nvme_core 131072 4 nvme
ghash_clmulni_intel 16384 0
serio_raw 20480 0
t10_pi 16384 1 nvme_core
dm_mirror 28672 0
dm_region_hash 24576 1 dm_mirror
dm_log 20480 2 dm_region_hash,dm_mirror
dm_mod 167936 8 dm_log,dm_mirror
- 选择一个没有被其它模块使用的模块，例如 vfat 模块！
- /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
[root@localhost ~]# modinfo vfat
filename: /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
author: Gordon Chaffee
description: VFAT filesystem support
license: GPL
alias: fs-vfat
srcversion: 444A191E60E27ED025AA29E
depends: fat
retpoline: Y
intree: Y
name: vfat
vermagic: 5.10.0-182.0.0.95.oe2203sp3.x86_64 SMP mod_unload modversions
sig_id: PKCS#7
signer: openEuler kernel signing key
sig_key: 07:FF:37:42:50:77:7E:17:83:B8:90:F6:BA:C5:5A:8F:B0:55:7C:74
sig_hashalgo: sha256
signature: 2C:DF:AB:79:00:49:33:A4:E6:B0:9F:75:52:CD:45:C1:33:BC:92:C0:
6D:5F:39:3B:0D:F9:97:D4:8E:8D:19:1F:59:B5:01:3D:C0:9A:98:CA:
66:60:29:15:01:4A:F2:D2:96:D9:E1:BF:7F:26:81:72:27:9C:83:9F:
E9:36:08:D0:C6:3E:E2:EC:5F:A2:49:19:87:E6:0F:82:25:67:85:C4:
38:12:9E:F4:10:60:D4:32:D0:4C:B7:21:5D:6C:0D:C8:90:C4:42:C0:
D2:CF:AD:2F:7B:6B:83:F1:A0:DF:6C:8D:25:DF:CD:03:6E:63:AC:8A:
D2:7E:4D:44:B4:CE:1F:54:20:68:B4:F1:F6:42:7A:F2:01:EA:71:B5:
4D:FE:9B:4B:12:43:9C:51:37:C5:53:6D:6E:49:BF:B8:F6:A9:29:3D:
E1:05:1F:37:46:A1:A6:41:2B:08:AB:C5:9A:09:5B:E0:2F:71:EB:19:
EB:D3:2C:DC:B6:E3:32:17:B0:9E:D1:A7:3B:5B:B6:FE:84:92:8B:5E:
99:FC:8C:6B:17:51:45:AD:1F:77:D4:A1:7E:24:F5:DB:C7:1B:28:F5:
6A:B7:88:B8:07:D1:59:06:22:0D:D6:70:5F:AC:F1:50:67:C0:BB:32:
07:3F:A0:12:93:34:4D:36:26:FC:44:B3:9F:D9:11:F2:BB:4A:3B:0F:
37:B1:D1:21:70:60:8B:2F:3F:B7:88:54:64:95:6D:B7:F5:35:45:A2:
29:90:62:20:63:77:AA:AC:02:9D:80:14:00:82:15:67:7F:FE:0D:21:
50:7D:44:41:33:5D:40:33:7E:D3:89:3D:63:22:C3:84:BC:78:25:F5:
77:76:7D:A6:AE:D3:52:19:B0:83:03:FE:CB:1B:6A:52:56:DF:82:C2:
A0:D2:56:D1:58:BB:C6:29:FF:A9:A7:7F:C2:9F:1B:8D:00:E4:64:CD:
75:34:B9:C2:CE:E6:2B:23:4E:18:FE:B0:67:D8:2F:CB:1A:03:F9:B6:
FF:17:0B:D1:B1:83:2A:FE:FF:33:EE:50:33:E5:51:B6:5E:58:72:B0:
0D:68:A2:C1:66:68:34:EC:3A:9F:3D:BC:43:91:7A:45:66:74:34:D0:
BF:7B:2A:95:3C:B5:78:16:95:17:04:91:64:0E:72:D4:B2:70:1E:96:
56:B8:A0:92:09:4E:D1:B0:68:F5:AC:5B:8C:10:F5:7A:70:82:3C:B3:
3B:60:77:0C:6C:E6:C2:82:89:9D:BB:C5:89:45:4C:15:9D:6B:3A:76:
7A:8F:BF:30:7E:AC:72:A4:67:D2:A9:40:69:44:C0:23:17:99:8D:6A:
2A:6E:D1:B2:8A:EB:5D:70:8D:EC:A7:79
- 测试vfat动态卸载与加载
[root@localhost ~]# rmmod vfat
[root@localhost ~]# insmod /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
4. 老内核加载新内核的驱动模块
[root@localhost ~]# rmmod vfat
[root@localhost ~]# lsmod | grep vfat
[root@localhost ~]# uname -r
5.10.0-182.0.0.95.oe2203sp3.x86_64
[root@localhost ~]# insmod /lib/modules/5.10.0-183.0.0.96.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
[root@localhost ~]# dmesg | grep vfat
[ 5832.797612] vfat: module verification failed: signature and/or required key missing - tainting kernel
[root@localhost ~]# lsmod | grep vfat
vfat 20480 0
fat 86016 2 msdos,vfat
- 老内核5.10.0-182.0.0.95.oe2203sp3.x86_64
- 新内核5.10.0-183.0.0.96.oe2203sp3.x86_64
- insmod加载模块时，使用绝对路径加载新内核5.10.0-183.0.0.96.oe2203sp3.x86_64的vfat驱动
- dmesg报告：vfat: module verification failed: signature and/or required key missing - tainting kernel
- lsmod显示实际上vfat已经加载，奇怪！
5. 新内核加载旧内核的驱动模块
[root@localhost ~]# uname -r
5.10.0-183.0.0.96.oe2203sp3.x86_64
[root@localhost ~]# lsmod | grep vfat
[root@localhost ~]# modprobe vfat
[root@localhost ~]# lsmod | grep vfat
vfat 20480 0
fat 86016 1 vfat
[root@localhost ~]# rmmod vfat
[root@localhost ~]# lsmod | grep vfat
[root@localhost ~]# insmod /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
[root@localhost ~]# dmesg | grep vfat
[ 97.051488] vfat: module verification failed: signature and/or required key missing - tainting kernel
[root@localhost ~]# lsmod | grep vfat
vfat 20480 0
fat 86016 1 vfat
- 老内核5.10.0-182.0.0.95.oe2203sp3.x86_64
- 新内核5.10.0-183.0.0.96.oe2203sp3.x86_64
- insmod加载模块时，使用绝对路径加载旧内核5.10.0-182.0.0.95.oe2203sp3.x86_64的vfat驱动
- dmesg报告：vfat: module verification failed: signature and/or required key missing - tainting kernel
- lsmod显示实际上vfat已经加载，奇怪！
6. 解读vfat: module verification failed: signature and/or required key missing - tainting kernel
对比modinfo的输出，可知不同的内核版本，使用了不同openEuler kernel signing key对模块进行签名！
- modinfo /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
- sig_key: 07:FF:37:42:50:77:7E:17:83:B8:90:F6:BA:C5:5A:8F:B0:55:7C:74
- modinfo /lib/modules/5.10.0-183.0.0.96.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
- sig_key: 25:11:CA:52:7B:45:C6:E7:F5:D3:9D:24:EE:F9:BB:C2:07:C6:6F:C0
[root@localhost ~]# modinfo /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
filename: /lib/modules/5.10.0-182.0.0.95.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
author: Gordon Chaffee
description: VFAT filesystem support
license: GPL
alias: fs-vfat
srcversion: 444A191E60E27ED025AA29E
depends: fat
retpoline: Y
intree: Y
name: vfat
vermagic: 5.10.0-182.0.0.95.oe2203sp3.x86_64 SMP mod_unload modversions
sig_id: PKCS#7
signer: openEuler kernel signing key
sig_key: 07:FF:37:42:50:77:7E:17:83:B8:90:F6:BA:C5:5A:8F:B0:55:7C:74
sig_hashalgo: sha256
signature: 2C:DF:AB:79:00:49:33:A4:E6:B0:9F:75:52:CD:45:C1:33:BC:92:C0:
6D:5F:39:3B:0D:F9:97:D4:8E:8D:19:1F:59:B5:01:3D:C0:9A:98:CA:
66:60:29:15:01:4A:F2:D2:96:D9:E1:BF:7F:26:81:72:27:9C:83:9F:
E9:36:08:D0:C6:3E:E2:EC:5F:A2:49:19:87:E6:0F:82:25:67:85:C4:
38:12:9E:F4:10:60:D4:32:D0:4C:B7:21:5D:6C:0D:C8:90:C4:42:C0:
D2:CF:AD:2F:7B:6B:83:F1:A0:DF:6C:8D:25:DF:CD:03:6E:63:AC:8A:
D2:7E:4D:44:B4:CE:1F:54:20:68:B4:F1:F6:42:7A:F2:01:EA:71:B5:
4D:FE:9B:4B:12:43:9C:51:37:C5:53:6D:6E:49:BF:B8:F6:A9:29:3D:
E1:05:1F:37:46:A1:A6:41:2B:08:AB:C5:9A:09:5B:E0:2F:71:EB:19:
EB:D3:2C:DC:B6:E3:32:17:B0:9E:D1:A7:3B:5B:B6:FE:84:92:8B:5E:
99:FC:8C:6B:17:51:45:AD:1F:77:D4:A1:7E:24:F5:DB:C7:1B:28:F5:
6A:B7:88:B8:07:D1:59:06:22:0D:D6:70:5F:AC:F1:50:67:C0:BB:32:
07:3F:A0:12:93:34:4D:36:26:FC:44:B3:9F:D9:11:F2:BB:4A:3B:0F:
37:B1:D1:21:70:60:8B:2F:3F:B7:88:54:64:95:6D:B7:F5:35:45:A2:
29:90:62:20:63:77:AA:AC:02:9D:80:14:00:82:15:67:7F:FE:0D:21:
50:7D:44:41:33:5D:40:33:7E:D3:89:3D:63:22:C3:84:BC:78:25:F5:
77:76:7D:A6:AE:D3:52:19:B0:83:03:FE:CB:1B:6A:52:56:DF:82:C2:
A0:D2:56:D1:58:BB:C6:29:FF:A9:A7:7F:C2:9F:1B:8D:00:E4:64:CD:
75:34:B9:C2:CE:E6:2B:23:4E:18:FE:B0:67:D8:2F:CB:1A:03:F9:B6:
FF:17:0B:D1:B1:83:2A:FE:FF:33:EE:50:33:E5:51:B6:5E:58:72:B0:
0D:68:A2:C1:66:68:34:EC:3A:9F:3D:BC:43:91:7A:45:66:74:34:D0:
BF:7B:2A:95:3C:B5:78:16:95:17:04:91:64:0E:72:D4:B2:70:1E:96:
56:B8:A0:92:09:4E:D1:B0:68:F5:AC:5B:8C:10:F5:7A:70:82:3C:B3:
3B:60:77:0C:6C:E6:C2:82:89:9D:BB:C5:89:45:4C:15:9D:6B:3A:76:
7A:8F:BF:30:7E:AC:72:A4:67:D2:A9:40:69:44:C0:23:17:99:8D:6A:
2A:6E:D1:B2:8A:EB:5D:70:8D:EC:A7:79
[root@localhost ~]# modinfo /lib/modules/5.10.0-183.0.0.96.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
filename: /lib/modules/5.10.0-183.0.0.96.oe2203sp3.x86_64/kernel/fs/fat/vfat.ko.xz
author: Gordon Chaffee
description: VFAT filesystem support
license: GPL
alias: fs-vfat
srcversion: 444A191E60E27ED025AA29E
depends: fat
retpoline: Y
intree: Y
name: vfat
vermagic: 5.10.0-183.0.0.96.oe2203sp3.x86_64 SMP mod_unload modversions
sig_id: PKCS#7
signer: openEuler kernel signing key
sig_key: 25:11:CA:52:7B:45:C6:E7:F5:D3:9D:24:EE:F9:BB:C2:07:C6:6F:C0
sig_hashalgo: sha256
signature: 20:62:89:61:9D:84:5C:35:AE:69:97:7A:82:9D:82:63:7C:33:A6:3A:
CE:E6:05:19:E4:CC:DE:60:6B:9C:B6:37:53:D3:A8:F0:11:D3:62:33:
FF:28:4C:5D:F9:CA:50:6D:87:0B:FE:DE:AA:58:D8:5D:71:88:8A:7E:
F1:9E:CA:C7:B8:0C:94:D2:E3:CA:53:F1:85:E2:DF:C5:E0:3F:65:AB:
AD:FF:0B:10:D1:D9:A1:66:89:CC:FB:AF:7E:47:D6:21:18:3F:A2:E8:
E2:88:7F:99:89:37:09:46:76:23:08:15:CA:92:42:4D:57:ED:96:AE:
85:0D:38:A1:B9:18:4D:1E:F4:39:02:29:A4:D3:0A:B3:7B:CE:63:5D:
20:2A:71:C4:D1:AC:98:C7:E9:B2:3D:DD:FE:93:06:25:2F:09:1B:C5:
3F:44:95:53:9E:69:9B:90:8B:32:C9:10:8B:72:92:1F:11:5A:13:BC:
EB:D3:5C:A8:9F:CC:6B:0A:D6:91:B0:A0:CE:AC:AE:26:60:5B:6F:16:
00:35:09:EF:6A:81:B4:7A:71:16:E2:BF:C7:D2:48:F2:37:32:06:A1:
6F:17:93:E7:A6:C3:07:3B:44:61:54:A0:04:21:05:F5:FF:E7:07:A4:
A5:97:84:5D:16:B7:64:E8:43:A2:7B:F4:75:B9:22:B8:40:4E:99:8C:
B6:FA:02:6F:9B:CC:9B:69:15:36:0C:1D:DB:66:4B:EB:2A:E6:CC:FF:
F7:90:0C:23:6C:18:6E:65:BC:6A:16:4E:A5:7D:F4:00:54:04:84:5C:
5C:B7:53:48:8D:B6:3B:DE:FB:0A:34:78:D5:E9:54:73:A5:91:93:45:
AA:D2:C9:40:2D:F1:68:CF:CA:27:0E:5F:24:FC:DC:81:B8:C0:27:D2:
2E:EF:C2:85:79:26:82:79:1C:6A:2A:BA:21:D5:C6:C3:BE:FB:7A:4B:
7E:B5:BB:33:74:02:C7:66:B5:ED:5C:87:EE:F6:72:07:72:C8:89:5A:
4E:D7:80:7E:86:2A:FA:ED:E2:D8:B1:B5:B8:2C:2A:4D:BF:BF:36:A1:
AE:31:2A:04:AD:B1:7E:A8:5B:63:47:4E:F6:16:87:7D:33:30:4D:DE:
B9:D8:82:3C:98:AD:0D:F1:A2:78:1B:F9:4F:1A:16:3E:25:CA:9A:61:
20:17:B1:DD:5C:15:EF:65:68:AF:68:73:2B:58:F5:A1:C3:67:1B:1A:
07:1D:90:7B:9D:BD:EE:5A:CC:9D:08:E5:76:84:0E:F1:54:45:98:73:
49:A5:64:AE:13:4F:30:8D:7E:BF:D0:6B:0E:93:49:DB:DD:57:4A:07:
E5:E8:5E:AF:28:EE:8A:C6:56:D2:70:46
7. 为什么仍然可以加载呢？
当出现 “module verification failed: signature and/or required key missing - tainting kernel” 的错误信息时，内核是否会拒绝模块加载取决于内核的配置选项。
-
非强制验证
如果内核配置中未启用强制模块签名验证（即未启用 CONFIG_MODULE_SIG_FORCE），内核在加载模块时会检查签名，但如果签名缺失或无效，内核不会拒绝加载模块，而是会打印警告信息并将内核标记为“tainted”（污染状态）。模块仍然会被加载，但系统可能会变得不稳定或存在安全风险。 -
强制验证行为
如果内核配置中启用了强制模块签名验证（即启用了 CONFIG_MODULE_SIG_FORCE），内核会要求所有模块必须具有有效的签名。在这种情况下，如果模块签名验证失败，内核会直接拒绝加载该模块，并输出类似以下错误信息：
ERROR: could not insert module <module_name>: Required key not available
最后，验证一下openEuler内核默认情况下，未启用 CONFIG_MODULE_SIG_FORCE！
[root@localhost ~]# cat /boot/config-5.10.0-183.0.0.96.oe2203sp3.x86_64 | grep CONFIG_MODULE_SIG_FORCE
# CONFIG_MODULE_SIG_FORCE is not set
补充龙蜥OS的情况：
[root@localhost ~]# cat /boot/config-5.10.134-16.3.an8.x86_64 | grep CONFIG_MODULE_SIG_FORCE
# CONFIG_MODULE_SIG_FORCE is not set
扫一扫
1720
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
