.KO

Introduction

A .ko file (“kernel object”) is a loadable module for the Linux kernel: a driver, file system or other feature that the kernel can load while running instead of having it built in. Modules are installed under /lib/modules/ followed by the kernel version, and tools such as modprobe load them along with the modules they depend on.

A module only loads into the kernel version it was built for, unless the kernel was built with symbol versioning and the symbols it uses match. Distributions often store modules compressed, as .ko.xz, .ko.zst or .ko.gz.

Structure

A kernel module is an ELF relocatable object file, the same kind as a .o file, which the kernel links into itself when it loads the module. A few sections are special to modules:

• .modinfo holds text entries such as license=GPL, description=, depends= and vermagic=, the kernel version and options the module was built for. modinfo prints them.
• .gnu.linkonce.this_module holds the module’s struct module, with its name and its init and exit functions.
• __versions, when symbol versioning is on, lists a checksum for each kernel symbol the module uses.

A signed module has its signature appended after the ELF data, followed by the text ~Module signature appended~ and a newline at the very end of the file.

Also used for

• Executable and Linkable Format .ko

Links