Implementing a Minimal Monolithic Kernel Module for Device Access

Part I — Article

Implementing a Minimal Monolithic Kernel Module for Device Access

When you open /dev/sda from userspace, you’re not talking to hardware — you’re calling into a kernel function registered by a driver. The kernel’s device model is a vtable lookup: your read() syscall traverses the VFS layer, finds the file_operations struct registered for that major/minor number pair, and jumps to whatever function pointer is sitting in .read. The driver author put that function there. That’s the entire contract.

A loadable kernel module (LKM) extends the running kernel without a reboot. It shares the kernel’s address space, runs at ring 0, and can dereference any kernel pointer directly. There’s no memory protection between modules — a NULL dereference in your driver oopses the whole kernel. This isn’t a bug in the design; it’s the trade-off that makes kernel code fast.

→ Subscribe now to access source code repository - 200 + coding lessons