1. What Is a Loadable Kernel Module?

A Loadable Kernel Module — usually just called an LKM or simply a “kernel module” — is a piece of compiled kernel code stored as a .ko file (kernel object). It can be inserted into a running kernel and removed from it without rebooting the machine.

Before LKMs existed, if you wanted to add support for a new piece of hardware, you had to recompile the entire kernel and reboot. This was impractical for both users and developers. LKMs solve this completely — you compile just the module, load it with one command, and your new driver is live.

Common use cases for kernel modules include:

2. The LKM Lifecycle

Every kernel module goes through a clear lifecycle. Understanding this lifecycle is the foundation of writing correct modules.

3. Your First Kernel Module — Hello World

Every programmer starts with Hello World. In the kernel world, this is especially meaningful because printing “hello” from inside the kernel means your code is running at Ring 0 — the most privileged level on the machine. Here is what the simplest possible kernel module looks like on kernel 6.x:

3.1 The Source File: hello.c

/*
 * hello.c - A minimal Linux kernel module for kernel 6.x
 *
 * This module prints a message when loaded and another
 * when removed. Nothing more, nothing less.
 *
 * Build: make (using the Makefile in the next section)
 * Load:  sudo insmod hello.ko
 * Check: dmesg | tail -5
 * Remove: sudo rmmod hello
 */

#include <linux/module.h>   /* Needed by all kernel modules        */
#include <linux/kernel.h>   /* Needed for KERN_INFO and printk()   */
#include <linux/init.h>     /* Needed for __init and __exit macros */

/* This function runs when the module is loaded */
static int __init hello_init(void)
{
    printk(KERN_INFO "hello: module loaded — welcome to kernel space!\n");
    return 0;   /* 0 = success. Returning non-zero aborts loading. */
}

/* This function runs when the module is removed */
static void __exit hello_exit(void)
{
    printk(KERN_INFO "hello: module removed — goodbye from kernel space!\n");
}

/* Tell the kernel which functions to call on load and unload */
module_init(hello_init);
module_exit(hello_exit);

/* Module metadata — required by the kernel */
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Your Name");
MODULE_DESCRIPTION("A minimal Hello World kernel module");
MODULE_VERSION("1.0");

Let us walk through every single line so there are no mysteries.

3.2 Line-by-Line Explanation

3.3 The __init and __exit Macros

These are not just decorative. __init tells the kernel linker to place the function in a special section of the binary called .init.text. After the module has finished loading and the init function has returned, the kernel frees the memory occupied by everything marked __init. This saves RAM at runtime.

Similarly, __exit places the function in a section that is only included when the module can be unloaded. If you build a module permanently into the kernel (not as a loadable module), the exit function is never called and the compiler can completely discard it.

4. Kernel Logging with printk()

Inside kernel code, printk() is the primary way to produce output. Unlike printf(), it does not go to your terminal. It writes to the kernel ring buffer — a circular buffer in kernel memory that stores recent log messages. You can read those messages with the dmesg command.

4.1 Log Levels

Every printk() call includes a log level prefix that controls how urgent the message is and whether it appears on the console:

In practice, use KERN_INFO for normal module messages and KERN_ERR when something goes wrong. Starting from kernel 4.x, there are convenient wrapper macros that combine the level and the call:

/* Modern preferred style in kernel 4.x and later */
pr_info("hello: module loaded successfully\n");
pr_err("hello: failed to allocate memory, error %d\n", ret);
pr_warn("hello: unexpected state encountered\n");
pr_debug("hello: debug checkpoint reached\n");

These pr_* macros are shorthand for printk(KERN_INFO ...) etc. and are the recommended style in modern kernel code (including all of kernel 6.x). They also automatically prepend your module name if you define pr_fmt.

4.2 Reading printk Output

# After loading your module, read the kernel log:
dmesg | tail -20

# With timestamps (kernel 6.x dmesg supports -T flag):
dmesg -T | tail -20

# Watch live kernel messages as they arrive:
dmesg --follow

# On systems using systemd-journald, you can also check:
sudo journalctl -k --since "5 minutes ago"

5. The Kernel Module Makefile

A kernel module cannot be built with a plain gcc hello.c -o hello. It must be built using the kernel’s own build system (called kbuild), which knows the exact compiler flags, include paths, and linker options needed to produce a valid .ko file. Here is the standard two-part Makefile for any kernel module:

5.1 The Makefile

# Makefile for hello.ko kernel module
#
# Usage:
#   make          - build the module
#   make clean    - remove build artifacts

# Name of the kernel object to build (without .ko)
obj-m += hello.o

# Path to the currently running kernel's build directory.
# The kernel headers installed on your system live here.
KDIR := /lib/modules/$(shell uname -r)/build

# Default target: invoke the kernel's kbuild system
all:
	make -C $(KDIR) M=$(PWD) modules

# Clean target: remove all generated files
clean:
	make -C $(KDIR) M=$(PWD) clean

5.2 What You Need Installed

# On Ubuntu / Debian:
sudo apt install build-essential linux-headers-$(uname -r)

# On Fedora / RHEL:
sudo dnf install kernel-devel kernel-headers gcc make

# On Arch Linux:
sudo pacman -S linux-headers base-devel

5.3 Complete Build and Test Workflow

# 1. Create your source directory
mkdir ~/my_first_module
cd ~/my_first_module

# 2. Create hello.c and Makefile (contents shown above)

# 3. Build the module
make

# You should see output ending with:
# LD [M]  /home/user/my_first_module/hello.ko

# 4. Check the module info before loading
modinfo hello.ko

# 5. Load the module
sudo insmod hello.ko

# 6. Check the kernel log for your printk output
dmesg | tail -5

# 7. Verify the module is loaded
lsmod | grep hello

# 8. Unload the module
sudo rmmod hello

# 9. Check the log again — exit message should appear
dmesg | tail -5

6. Module Information and Common Commands

The kernel tracks all loaded modules and their details. Here is a reference of the most commonly used commands when working with kernel modules:

7. GPL License and the Tainted Kernel

You might wonder why MODULE_LICENSE("GPL") is so important. The Linux kernel is licensed under the GNU General Public License version 2. When you load a module, the kernel checks its license. If the module declares a non-GPL-compatible license — or no license at all — the kernel marks itself as “tainted”.

A tainted kernel is not broken, but it means the kernel developers may refuse to help you debug issues. The taint flag is shown in kernel oops and panic messages. As a developer, you should always use MODULE_LICENSE("GPL") for educational and open-source modules. For commercial modules, "GPL v2" and "Dual MIT/GPL" are also common.

/* Valid MODULE_LICENSE values */
MODULE_LICENSE("GPL");          /* Most common */
MODULE_LICENSE("GPL v2");
MODULE_LICENSE("GPL and additional rights");
MODULE_LICENSE("Dual MIT/GPL");
MODULE_LICENSE("Dual BSD/GPL");