The Linux Concept Journey — Loadable Kernel Module (LKM)

A loadable kernel module (LKM) allows us to add code to the Linux kernel without the need of recompiling and linking the kernel binary. This is used for different use cases such as (but not limited to) filesystem drivers and device drivers (https://tldp.org/HOWTO/Module-HOWTO/x73.html).

Overall, when compiling the Linux kernel we can decide if we want to incorporate a specific kernel module as part of the kernel itself (also called built-in kernel modules — more details on them in future writeups) or as a separate “*.ko” (kernel object) file. In case the kernel is already compiled we only have the option of creating a kernel object file which can be later loaded by using the “insmod” utility (https://man7.org/linux/man-pages/man8/insmod.8.html).

Moreover, a kernel object file has the same type as an ordinary object file (before it is linked and can be executed in user mode) — as shown in the screenshot below. This type is called relocatable and is defined as “ET_REL” (https://man7.org/linux/man-pages/man5/elf.5.html).

Lastly, we can dynamically check the list of the actively loaded kernel modules using the “lsmod” (https://man7.org/linux/man-pages/man8/lsmod.8.html) utility — as shown in the screenshot below. “lsmod” basically parses “/proc/modules” (https://man7.org/linux/man-pages/man5/proc.5.html).