I'm building a totally custom initramfs for a netbooting project and in the process learning a lot about it, but I'm a little puzzled by the loading of modules.

I know modprobe can be used to load modules, but how does it decide which modules to load?

What I have right now is the initramfs booting up and running a shell in virtual box. But lsmod shows no modules loaded. What I need init to do is load the right modules for the networking so that I can get the networking up.

If I modprobe e1000 I actually get the correct module loaded.

In looking through the Ubuntu boot process I can't see how Ubuntu decides it should load up e1000. I would've thought it'd just modprobe every available network card driver, but it doesn't appear to be doing that.

I'm guessing that UDEV has something to do with it?


1 Answer 1


I know modprobe can be used to load modules, but how does it decide which modules to load?

When the kernel needs a feature that is not resident in the kernel, the kernel module daemon kmod1 execs modprobe to load the module in. modprobe is passed a string in one of two forms.

  • A module name like softdog or ppp.
  • A more generic identifier like char-major-10-30

So, let me explain what I found in my system rather than pasting from the link.

cat /proc/modules - This command lists what modules are loaded and the list is a pretty huge list.

Now, during the start up of the system, as I had already mentioned, the kmod daemon executes the modprobe to load the modules. We could specify the module to be loaded in either of 2 ways as already discussed. If we have specified a generic identifier, it will look for that entry in /etc/modprobe.conf for alias. So, in my /etc/modprobe.conf, I have an alias as below.

alias eth0 tg3

So, I ran the below command to check what is tg3 in my system.

-bash-3.2$ cat /proc/modules | grep tg3
tg3 139225 0 - Live 0xf8bd1000

Next, modprobe looks through the file /lib/modules/version/modules.dep, to see if other modules must be loaded before the requested module may be loaded. This file is created by depmod -a and contains module dependencies.

Lastly, modprobe uses insmod to first load any prerequisite modules into the kernel, and then the requested module. modprobe directs insmod to /lib/modules/version/[3], the standard directory for modules. insmod is intended to be fairly dumb about the location of modules, whereas modprobe is aware of the default location of modules, knows how to figure out the dependencies and load the modules in the right order.

But how is the new hardware detected?

                                    CPU Privilege rings

These rings are created by CPU and not by OS. Any OS kernel operates in Ring 0 which is most privileged level and can communicate directly to the hardware and the CPU. Rings 1 and 2 are commonly used for device drivers. And ring 3 is used for user-space applications (media players, web servers and anything else user can communicate to directly). Device drivers are a “bridge” between user-space applications and hardware.

Linux kernel constantly scans all your computer bus’es for any changes and new hardware. Once any change on any bus is detected magic begins.

The Magic

    • Yeah, your assumption is correct. udev has something to do with the magic :)*

Udevd is just a daemon standing in between the Kernel and all the udev system and perform some important functions (I’ll mention them later). The udev daemon (udevd) is started at startup then reads and parses all the rules found in /etc/udev/rules.d/ and keep these rules in memory (udev database) for further usage by udev. Later udevd start to listen on the netlink for uevents comming from Kernel driver core.


  • kmod doesn't do anything unless it's told. It's what drives it that is of importance to me. i.e. "The Magic". Is this simply done by starting udevd? and what's the difference between udevd and system-udevd that ubuntu has?
    – hookenz
    Apr 29, 2014 at 1:42
  • @MattH, udev is a generic kernel device manager. It runs as a daemon on a Linux system and listens (via netlink socket) to uevents the kernel sends out if a new device is initialized or a device is removed from the system. So "The Magic" is done by starting udevd, I suppose.
    – Ramesh
    Apr 29, 2014 at 1:53
  • @MattH, From system-udevd manpage, I see it is Device event managing daemon and in udevd manpage, I see it is even managing daemon. So, I suppose they basically serve the same purpose.
    – Ramesh
    Apr 29, 2014 at 1:57
  • Turns out on ubuntu udevd is a symbolic link to system-udevd. But merely starting udevd doesn't make the modules load up and I still don't see what scripts are creating the network card modules. Some modules are specifically added to the running kernel with modprobe directly from init scripts. I can't see that for the network card.
    – hookenz
    Apr 29, 2014 at 2:05
  • 1
    Forget about rings 1 and 2. These are specific to x86 processors and Linux doesn't use them (nor any other unix variant AFAIK). Kernel/user mode is pretty much universal. In a classical unix architecture, and in most modern unices as well, drivers run in kernel mode. Apr 29, 2014 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .