The Linux Kernel Module Programming Guide (LKMPG) is a comprehensive, community-maintained guide to writing Linux kernel modules. It consists of a LaTeX book and a large collection of example kernel modules that demonstrate a wide range of kernel APIs and programming patterns, including character devices, the /proc filesystem, sysfs, debugfs, system call interception, synchronization primitives (mutex, spinlock, rwlock, RCU), interrupt handling, timers, workqueues, block devices, network drivers, DMA, device tree, GPIO, and more. The repository also includes a QEMU-based development environment (devtools) that automates building a minimal kernel and initramfs, allowing developers to compile and test modules inside a virtual machine without affecting their host system. The code is well-structured, follows kernel coding conventions, and includes proper error handling and cleanup. Many examples include version guards for compatibility across different kernel versions (5.10 through 6.17+). The devtools scripts are robust, with caching, idempotency, and prebuilt binary support to speed up setup. The CI pipeline builds the book, compiles all examples, runs static analysis (cppcheck, sparse, gcc, smatch), and tests module loading/unloading in both bare-metal and QEMU environments. While primarily educational, the example modules are self-contained and can serve as templates for real kernel module development. The devtools provide a reproducible environment for kernel module testing, which is valuable for developers working on out-of-tree modules. The repository is actively maintained and targets recent Linux 5.x and 6.x kernels.
The openwifi repository provides a full-stack IEEE 802.11 (Wi-Fi) implementation for Software Defined Radio (SDR) hardware, specifically targeting Xilinx Zynq/ZynqMP SoCs with AD9361/AD9364 RF transceivers. It consists of a Linux kernel driver (split into multiple modules for OFDM, TX/RX interfaces, and side-channel processing) and user-space tools for hardware configuration, FPGA bitstream loading, and Wi-Fi interface management. The system supports standard Wi-Fi modes (AP, STA, ad-hoc, monitor) and experimental features like Channel State Information (CSI) extraction, packet injection/fuzzing, and radar sensing. The build system uses Buildroot to generate bootable SD card images, and the project includes extensive documentation for experimentation and hardware bring-up.
simplefs is a Linux kernel module that implements a simple extent-based filesystem for educational use, accompanied by a userspace mkfs.simplefs formatter. The kernel component registers a VFS filesystem type and implements superblock, inode, file, and directory operations. The on-disk layout is a fixed 4 KiB block format: superblock, inode store, inode free bitmap, block free bitmap, and data blocks. Inodes are 72 bytes and point to an extent-index block; regular files use extents of up to 8 contiguous blocks (maximum file size around 10.65 MiB), while directories use a hashed ring of extents to support up to 40,920 entries. Functionally, the filesystem supports create, lookup, unlink, rename, hard links, symbolic links, mkdir, rmdir, and read/write. File I/O is implemented through both traditional VFS page-cache helpers and simpler direct buffer-head read/write paths, making the code a useful teaching reference for how Linux VFS callbacks and buffer management interact. External journaling is supported via the kernel's jbd2 subsystem, mounted with a journal_path or journal_dev option, though only extent metadata is journaled and the journal size is currently hardcoded. Entry points are module_init/module_exit in fs.c, the mount path through simplefs_fill_super in super.c, and main() in mkfs.c. Dependencies are Linux kernel headers, jbd2, block-device APIs, and a Linux or macOS host for mkfs. The repository includes shell-based integration tests that exercise maximum directory fill, large-file behavior, remount persistence, random create/delete, and free-block reclamation, plus CI jobs for formatting and macOS mkfs verification. The code maintains compatibility macros spanning Linux 5.10 through 7.3, reflecting active upkeep.
LiME is a Linux kernel module (LKM) for volatile memory acquisition from Linux and Android systems, widely used in digital forensics and incident response. It dumps physical memory ranges marked as "System RAM" by walking the kernel's iomem resource tree, writing output to a local file or streaming over a TCP connection. The module supports three output formats (raw, padded, and lime with metadata headers), optional zlib compression, optional cryptographic digest sidecar files (leveraging the kernel's crypto API), and direct I/O. It minimizes interaction with user space during capture to produce more forensically sound images. The architecture is a classic kernel module with clearly separated concerns: main.c drives the iomem traversal and orchestrates output via vtable-like structures; tcp.c and disk.c provide network and file-system transport; hash.c wraps three generations of kernel crypto APIs (ahash, hash, tfm) for portable digest support; and deflate.c wraps zlib with balanced memory settings. The codebase is aggressively version-aware, supporting kernels from 2.6.11 through 6.19 with conditionally compiled code paths for API breakpoints (e.g., set_fs removal, kmap_local_page, sock_set_reuseaddr). The project ships an exceptionally thorough CI/CD pipeline (GitHub Actions) that compiles against eight pinned kernel series and a canary latest-kernel build, runs sparse static analysis and custom grep-based source checks, and boots real kernels in QEMU to perform runtime smoke tests of all output formats, digest, and compression. A self-contained local testing harness (Docker) enables developers to reproduce the full CI matrix offline. Configuration management, kernel tree caching, and version pinning are handled by well-documented scripts that are themselves reusable for other kernel module projects.
Sysdig is a mature, open-source system monitoring and troubleshooting CLI tool that instruments the Linux kernel to capture system calls and other OS events. It provides a rich curses-based interactive UI (csysdig) and an extensible Lua chisel framework for real-time analysis of CPU, I/O, network, security, and container metrics. The codebase is predominantly C++ with a Lua scripting layer, and includes a comprehensive plugin system for alternative event sources (e.g., gVisor, custom plugins). It also ships a large set of kernel driver build configurations (driverkit) for supporting many Linux distributions and kernel versions. The architecture is a classic CLI application with a modular design: libsinsp for event introspection, chisels for analysis, and a curses UI for visualization. The project is actively maintained by the Sysdig team and the Falco community, with regular commits and CI pipelines.
Netmap is a high-performance packet I/O framework that bypasses the kernel network stack, providing memory-mapped rings for zero-copy packet processing. It consists of a kernel module (character device /dev/netmap), a user-space library (libnetmap), and a suite of applications (pkt-gen, bridge, nmreplay, lb, dedup, etc.). The architecture supports multiple NICs via native driver adapters (Intel, Mellanox, VMware, virtio, etc.) or a generic emulation layer, and includes an in-kernel virtual switch (VALE), inter-process pipes, and traffic monitors. Key entry points are the kernel module's ioctl/poll/mmap operations and the user-space library's port specification parser. Data flows involve memory-mapped rings synchronized via system calls or a lock-free Communication Status Block (CSB). External dependencies include kernel APIs, NIC driver internals, and standard C libraries. The project is cross-platform (FreeBSD, Linux, Windows) and originates from academic research at the University of Pisa.
Open CAS Linux is a production-grade block-layer cache acceleration solution for Linux. It consists of a kernel module (`cas_cache`) implementing caching logic on top of the OCF (Open Cache Framework), a block device module (`cas_bd`), and a user-space management CLI (`casadm`). The system accelerates block I/O by caching hot data on fast storage (e.g., NVMe/Optane) while using slower backing storage, with support for multiple cache modes, cleaning policies, I/O classes, and statistics reporting. Management is performed via ioctls through `/dev/cas_ctrl` and netlink-based communication, with a comprehensive CLI (`casadm`) for cache/core lifecycle operations and statistics output in text, CSV, and raw CSV formats.
This repository implements AMD's MxGPU virtualization solution, providing SR-IOV support for AMD GPUs (MI200, MI300, Navi32). It consists of a kernel module (GIM) that manages virtual functions, a core library (libgv) for hardware abstraction and RAS, and a user-space system management interface (SMI) with CLI and Python bindings. The architecture is layered: the kernel driver (gim/) communicates with hardware and exposes IOCTLs; libgv/ provides hardware-specific implementations via function pointer tables; smi-lib/ provides a unified API for monitoring, partitioning, RAS, and NIC management. Key entry points include the GIM kernel module (gim/gim_shim/gim_drv.c), the SMI CLI (smi-lib/cli/cpp/src/smi_cli_main.cpp), and the SMI library (smi-lib/src/amdsmi.c). Data flows involve PF-VF mailbox communication, RAS error logging via CPER, and telemetry collection through SMU firmware interfaces. External dependencies include Linux kernel headers, DKMS, and optional NIC libraries. The codebase is large and professionally structured, with extensive hardware abstraction layers, unit tests, and packaging scripts, though it carries maintenance risks from ASIC-specific duplication and embedded firmware blobs.
This repository provides a kernel module for tracing user-space functions using uprobe, along with a user-space tool to clear uprobes. The kernel module hooks into the mincore system call to set up tracing parameters and function probes. It uses a red-black tree implementation to store function information. The module is designed for Android and has been tested on kernel versions 5.10 and 5.15, with claimed support for 6.x kernels. The user-space tool is a simple executable that invokes the mincore system call to clear all set uprobes.