2.1.3. Kernel Modules and Hardware Device Management
💡 First Principle: The Linux kernel is modular by design — core functionality is always loaded, but optional functionality lives in kernel modules that are loaded and unloaded at runtime. This means you can add driver support for new hardware without rebooting, and remove unused drivers to reduce the attack surface.
When a new hardware device appears (USB drive, network card, GPU), the kernel detects it via the hardware bus, looks for a matching driver module, loads it, and creates the appropriate /dev entry. If the module is missing or incompatible, the device simply won't work — no error message from the hardware, just absence.
Kernel Module Commands:
| Command | Purpose | Example |
|---|---|---|
lsmod | List currently loaded modules | lsmod | grep kvm |
modinfo | Show module metadata and parameters | modinfo e1000e |
modprobe | Load a module (resolves dependencies) | modprobe overlay |
modprobe -r | Remove a module | modprobe -r pcspkr |
insmod | Load a module (no dependency resolution) | insmod /path/to/module.ko |
rmmod | Remove a module (no dependency checking) | rmmod pcspkr |
depmod | Rebuild module dependency map | depmod -a |
Always prefer modprobe over insmod and rmmod — modprobe handles dependencies automatically, while insmod/rmmod operate on single modules and will fail if dependencies aren't satisfied.
Hardware Device Query Tools:
dmesg # Kernel ring buffer — hardware detection events
dmesg | grep -i error # Filter for hardware errors
lscpu # CPU architecture, cores, NUMA topology
lsmem # Memory banks and sizes
lspci # PCI devices (NICs, GPUs, storage controllers)
lsusb # USB devices
lshw # Comprehensive hardware inventory (requires root)
dmidecode # DMI/SMBIOS data — chassis, BIOS, memory modules
ipmitool # Out-of-band management (IPMI/BMC interface)
lm_sensors # CPU and motherboard temperature/voltage sensors
nvtop # GPU utilization (for NVIDIA/AMD GPUs)
initrd Management:
When you install a new kernel, a new storage driver, or change the root filesystem type, you must rebuild the initramfs so the new boot image includes the necessary drivers:
# RHEL/Fedora/Rocky
dracut --force # Rebuild initramfs for current kernel
dracut -f /boot/initramfs-$(uname -r).img $(uname -r) # Explicit paths
# Debian/Ubuntu
mkinitramfs # Lower-level legacy tool (mkinitrd is the RHEL/SUSE legacy equivalent)
update-initramfs -u # Update current kernel's initramfs
GPU use cases in XK0-006 scope: nvtop for monitoring GPU utilization in ML/AI workloads. Embedded systems (Raspberry Pi, industrial controllers) often use AArch64 and require architecture-specific kernel modules.
⚠️ Exam Trap: insmod does NOT resolve module dependencies — if module A requires module B, insmod A.ko will fail with an "Unknown symbol" error. modprobe reads the dependency map built by depmod and loads dependencies in the correct order automatically. Exam questions about loading kernel modules should use modprobe.
Reflection Question: You plug in a USB NIC and nothing happens — no /dev entry, no dmesg output about the device. After confirming the hardware works on another machine, what is the most likely Linux-side cause and how would you diagnose it?
