Linux - Linux Kernel Modules and Dynamic Driver Management

A Linux kernel module is a piece of code that can be loaded into or removed from the Linux kernel while the system is running. Kernel modules allow Linux to extend its functionality without requiring the entire kernel to be recompiled or the computer to be restarted. They are commonly used for hardware drivers, filesystems, networking features, and other kernel-level functionality.

1. What is the Linux Kernel?

The Linux kernel is the central component of a Linux operating system. It manages communication between hardware and software and provides essential services such as process management, memory management, device management, networking, and filesystem operations.

Because the kernel operates with high privileges, adding new functionality directly to it can be complex. Kernel modules provide a flexible solution. Instead of compiling every possible driver or feature directly into the kernel, Linux can keep many components as separate modules and load them only when required.

For example, when a computer detects a particular network adapter, Linux may load the appropriate kernel module that provides support for that hardware.

2. What is a Loadable Kernel Module?

A Loadable Kernel Module (LKM) is a compiled piece of code that can be dynamically inserted into the running Linux kernel.

Modules normally have the .ko extension, which stands for kernel object. They are generally stored under directories such as:

/lib/modules/<kernel-version>/

For example:

/lib/modules/6.x.x/

A module can provide functionality such as:

  • Hardware device drivers

  • Network drivers

  • Filesystem support

  • USB device support

  • Sound device support

  • Virtualization-related functionality

  • Specialized kernel features

The major advantage is that the functionality can be added when needed instead of being permanently built into the kernel.

3. Why Does Linux Use Kernel Modules?

Linux supports a huge variety of hardware and technologies. Including every possible driver and feature directly inside the kernel would make the kernel unnecessarily large.

Kernel modules provide several advantages.

Flexibility: New functionality can be added without rebuilding the entire kernel.

Efficient resource usage: Modules that are not required do not need to remain loaded in memory.

Hardware support: Drivers can be dynamically loaded when compatible hardware is detected.

Maintenance: A specific driver or feature can sometimes be updated independently of the complete kernel.

Troubleshooting: Administrators can load, unload, and inspect modules when diagnosing hardware or kernel-related problems.

4. Kernel Module and Device Driver

A kernel module and a device driver are related but are not exactly the same thing.

A device driver is software that enables the operating system to communicate with a particular hardware device. A driver can be implemented as a kernel module, although some drivers may be built directly into the kernel.

For example, a Wi-Fi adapter requires software that understands how to communicate with that particular hardware. Linux can provide that functionality through a kernel module.

The relationship can be understood as:

Application
     |
     v
Linux system calls
     |
     v
Linux kernel
     |
     v
Device driver
     |
     v
Hardware

When the driver is implemented as a loadable module, Linux can dynamically load it when required.

5. Checking Currently Loaded Modules

The lsmod command displays the kernel modules currently loaded into memory.

lsmod

A typical output might look like:

Module                  Size  Used by
snd_hda_intel          53248  3
usb_storage            77824  1
i915                  376832  5

The important columns include the module name, its size, and information about whether other components are using it.

lsmod essentially provides a convenient view of information maintained by the Linux kernel about currently loaded modules.

6. Loading a Kernel Module with modprobe

The preferred method for loading most modules is modprobe.

sudo modprobe module_name

For example:

sudo modprobe usb_storage

modprobe is more sophisticated than simply inserting a module file. It can identify and load dependencies required by the requested module.

Suppose module A depends on module B. If you attempt to load A using modprobe, Linux can automatically load B first.

This makes modprobe particularly useful on production systems because administrators generally do not need to manually determine every module dependency.

7. Removing a Module with modprobe

A module that is no longer required can often be removed using:

sudo modprobe -r module_name

For example:

sudo modprobe -r usb_storage

Linux will normally prevent removal if the module is currently being used by another component.

This protection is important because forcibly removing a module that is actively being used could cause system instability or hardware malfunction.

8. insmod Command

Another command for inserting a module is insmod.

sudo insmod module_name.ko

Unlike modprobe, insmod works directly with the specified module file and does not automatically resolve module dependencies in the same convenient way.

For this reason, modprobe is generally preferred for normal system administration.

insmod can still be useful when developing or testing a specific kernel module and when the administrator has direct control over its dependencies.

9. rmmod Command

The rmmod command removes a loaded kernel module.

sudo rmmod module_name

For example:

sudo rmmod usb_storage

Like other module-removal mechanisms, the operation can fail when the module is currently being used.

In general, modprobe -r is often more convenient because it can account for module relationships and dependencies.

10. Understanding Module Dependencies

Kernel modules can depend on other modules.

For example:

Module A
   |
   v
Module B
   |
   v
Module C

If Module A requires functionality supplied by Module B, Module B must be available before Module A can operate correctly.

Linux maintains information about module dependencies. The modprobe command uses this information to determine which additional modules need to be loaded.

The modinfo command can provide information about a particular module:

modinfo module_name

For example:

modinfo e1000e

The output can contain information such as the module filename, description, author, license, version, aliases, and dependencies.

11. Finding Where a Module Is Stored

The modinfo command can also show the location of a module.

modinfo -n module_name

For example:

modinfo -n e1000e

This can return a path similar to:

/lib/modules/6.x.x/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko

The exact location depends on the Linux distribution and kernel version.

12. Automatic Module Loading

Linux can automatically load modules when they are required.

This is particularly important for hardware.

For example, when a USB device is connected, the Linux device-management infrastructure can recognize the device and request the appropriate driver. If the driver is available as a module, it can be loaded automatically.

The general process is:

Hardware detected
        |
        v
Device identification
        |
        v
Matching driver/module found
        |
        v
Kernel module loaded
        |
        v
Device becomes available

This means users normally do not need to manually run modprobe every time they connect a supported device.

13. Module Aliases

Linux uses aliases to associate hardware identifiers with appropriate drivers.

A module can contain aliases that tell the system which types of hardware it supports.

The command:

modinfo module_name

can display these aliases.

This mechanism is important for automatic driver loading because Linux can identify a hardware device and search for a module that declares compatibility with that device.

14. Module Configuration

Administrators can configure module behavior using configuration files.

On many Linux distributions, module configuration files are located under:

/etc/modprobe.d/

For example, a configuration file might contain:

options module_name option=value

This allows administrators to provide parameters to a module when it is loaded.

A module can therefore be loaded with specific behavior without modifying its source code.

15. Blacklisting a Module

Sometimes a particular module should not be automatically loaded. Linux provides module blacklisting for this purpose.

A configuration file under:

/etc/modprobe.d/

can contain:

blacklist module_name

For example:

blacklist example_driver

Blacklisting can be useful when two drivers conflict, when an unwanted driver is being automatically selected, or when an administrator needs to prevent a particular module from loading.

However, blacklisting should be performed carefully because preventing an essential driver from loading can make associated hardware unavailable.

16. Module Parameters

Kernel modules can accept parameters that modify their behavior.

For example:

sudo modprobe module_name parameter=value

The available parameters depend on the particular module.

To inspect available information, administrators can use:

modinfo module_name

Module parameters are particularly useful when a driver supports different operating modes or when hardware requires specific configuration.

17. Kernel Module Security

Kernel modules operate inside the kernel and therefore have extremely high privileges. A faulty or malicious module can potentially affect the entire operating system.

For this reason, Linux systems can use mechanisms such as module signing.

A signed kernel module contains a cryptographic signature that can be checked by the kernel before the module is loaded. On systems using Secure Boot and appropriate kernel configuration, unsigned or improperly signed modules may be rejected.

This provides an additional layer of protection against unauthorized kernel-level code.

18. Troubleshooting Kernel Modules

When a module fails to load, administrators can investigate kernel messages.

The dmesg command is commonly useful:

dmesg | tail

For systems using systemd, the journal can also be examined:

journalctl -k

These commands can reveal problems such as:

  • Missing dependencies

  • Unsupported hardware

  • Incorrect module parameters

  • Firmware problems

  • Module initialization failures

  • Hardware communication errors

  • Kernel compatibility issues

A common troubleshooting process is:

Identify hardware/problem
        |
        v
Check loaded modules
        |
        v
Inspect module information
        |
        v
Check kernel messages
        |
        v
Load or reload appropriate module
        |
        v
Verify device functionality

19. Built-in Drivers vs Loadable Modules

Not every Linux driver is a loadable module.

A feature can be compiled directly into the kernel or compiled as a separate module.

A built-in driver is permanently part of the kernel image and is available as soon as the kernel starts.

A loadable module is separate from the kernel image and can be loaded or unloaded dynamically.

The choice depends on the functionality. Components that are essential for the system to start may need to be built into the kernel or made available very early through the boot process.

20. Practical Example

Suppose a Linux server has a network adapter and the administrator wants to determine which driver is being used.

First, the administrator can identify the network hardware:

lspci -k

The output may include information about the network controller and the kernel driver currently in use.

The administrator can then inspect the driver:

modinfo driver_name

The loaded module can be checked with:

lsmod

If the driver is not loaded and is available as a module, it can potentially be loaded with:

sudo modprobe driver_name

After loading it, the administrator can check kernel messages:

dmesg | tail

Finally, the network interface can be checked using:

ip link

This sequence demonstrates how hardware identification, module inspection, module loading, and verification work together.

21. Important Commands at a Glance

Command Purpose
lsmod Displays currently loaded modules
modprobe Loads a module and handles dependencies
modprobe -r Removes a module
insmod Inserts a specific .ko module
rmmod Removes a loaded module
modinfo Displays information about a module
modinfo -n Shows the module's file path
lspci -k Shows PCI devices and their kernel drivers
dmesg Displays kernel messages
journalctl -k Displays kernel-related system journal messages

Conclusion

Linux kernel modules provide a flexible mechanism for extending the Linux kernel without rebuilding or restarting the entire operating system. They are particularly important for hardware drivers, filesystems, networking functionality, and other kernel-level capabilities.

Commands such as lsmod, modprobe, modinfo, insmod, and rmmod allow administrators to inspect and manage modules. Understanding module dependencies, automatic loading, configuration, parameters, blacklisting, and security is essential for effective Linux system administration and troubleshooting.

The key concept to remember is that a kernel module is dynamically loadable kernel functionality, while a device driver is software that allows the operating system to communicate with hardware; many Linux device drivers are implemented as kernel modules.