Loadable kernel module

Loadable kernel module

In computing, a loadable kernel module (or LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. Most current Unix-like systems, and Microsoft Windows, support loadable kernel modules, although they might use a different name for them, such as kernel loadable module (kld) in FreeBSD and kernel extension (kext) in Mac OS X. They are also known as Kernel Loadable Modules (or KLM), and simply as Kernel Modules (KMOD). LKMs are typically used to add support for new hardware and/or filesystems, or for adding system calls. When the functionality provided by an LKM is no longer required, it can be unloaded in order to free memory.



Without loadable kernel modules, an operating system would have to have all possible anticipated functionality already compiled directly into the base kernel. Much of that functionality would reside in memory without being used, wasting memory, and would require that users rebuild and reboot the base kernel every time new functionality is desired. Most operating systems supporting loadable kernel modules will include modules to support most desired functionality.


Loadable kernel modules in Linux are loaded by the modprobe command. They are located in /lib/modules and they have had the extension .ko ("kernel object") since version 2.6.[1] The lsmod command lists the loaded kernel modules.

License issues

In the opinion of Linux maintainers, LKM are derived works of the kernel. The Linux maintainers tolerate the distribution of proprietary modules, but allow symbols to be marked as only available to GNU General Public License (GPL) modules.


Loading a proprietary or non-GPL-compatible LKM will set a 'taint' flag[2] in the running kernel—meaning that any problems or bugs experienced will be less likely to be investigated by the maintainers.[3][4] LKMs effectively become part of the running kernel, so can corrupt kernel data structures and produce bugs that may not be able to be investigated if the module is indeed proprietary.

Linuxant controversy

In 2004, Linuxant—a consulting company that releases proprietary device drivers as loadable kernel modules—attempted to bypass GPLONLY symbol restrictions by abusing a NULL terminator in their MODULE_LICENSE:

MODULE_LICENSE("GPL\0for files in the \"GPL\" directory; for others, only LICENSE file applies");

The string comparison code used by the kernel at the time tried to determine whether the module was GPLed stopped when it reached a null character (\0), so it would be fooled into thinking that the module was declaring its licence to be just "GPL". The GPL directory referred to in the rest of the licence string was empty.[5]


Kernel modules for FreeBSD are stored within /boot/kernel/ for modules distributed with the OS, or usually /boot/modules/ for modules installed from FreeBSD ports or FreeBSD packages, or for proprietary or otherwise binary-only modules. FreeBSD kernel modules usually have the extension .kld. Once the machine has booted, they may be loaded with the kldload command, unloaded with kldunload, and listed with kldstat. Modules can also be loaded from the loader before the kernel starts, either automatically (through /boot/loader.conf) or by hand.

Mac OS X

Some loadable kernel modules in Mac OS X can be loaded automatically. Loadable kernel modules can also be loaded by the kextload command. They can be listed by the kextstat command. Loadable kernel modules are located in application bundles with the extension .kext. Modules supplied with the operating system are stored in the /System/Library/Extensions directory; modules supplied by third parties are in various other directories.

Fragmentation penalty

One minor criticism of preferring a modular kernel over a static kernel is the so-called Fragmentation Penalty. The base kernel is always unpacked into real contiguous memory by its setup routines; so, the base kernel code is never fragmented. Once the system is in a state where modules may be inserted—for example, once the filesystems have been mounted that contain the modules—it is probable that any new kernel code insertion will cause the kernel to become fragmented, thereby introducing a minor performance penalty.[citation needed]

Binary compatibility

Linux does not provide a stable API or ABI for kernel modules. This means that there are differences in internal structure and function between different kernel versions, which can cause compatibility problems. In an attempt to combat those problems, symbol versioning data is placed within the .modinfo section of loadable ELF modules. This versioning information can be compared with that of the running kernel before loading a module; if the versions are incompatible, the module will not be loaded.

Other operating systems, such as Solaris, FreeBSD, Mac OS X, and Windows keep the kernel API and ABI relatively stable, thus avoiding this problem. For example, FreeBSD kernel modules compiled against kernel version 6.0 will work without recompilation on any other FreeBSD 6.x version, e.g. 6.4. However, they are not compatible with other major versions and must be recompiled for use with FreeBSD 7.x, as API and ABI compatibility is maintained only within a branch.


While loadable kernel modules are a convenient method of modifying the running kernel, this can be abused by an attacker on a compromised system to prevent detection of his processes or files, allowing him to maintain control over the system. Many rootkits make use of LKMs in this way. Note that modules do not help in any way in privilege elevation, as root access is required to load a LKM; they merely make it easier for the attacker to hide the break-in.[citation needed]

See also


External links

Wikimedia Foundation. 2010.

См. также в других словарях:

  • Loadable Kernel Module — Dans un système d exploitation, un module est une partie du noyau qui peut être intégrée pendant son fonctionnement. Le terme anglais généralement employé pour les désigner est Loadable Kernel Module, abrégé LKM, ou en français :… …   Wikipédia en Français

  • Kernel-based Virtual Machine — Infobox Software name = Kernel based Virtual Machine logo = caption = Screenshot of the Windows XP boot up process in a qemu/kvm window in Fedora 7. developer = latest release version = 75 latest release date = release date|2008|09|10 operating… …   Wikipedia

  • Module — A module is a self contained component of a system, which has a well defined interface to the other components; something is modular if it includes or uses modules which can be interchanged as units without disassembly of the module. Design,… …   Wikipedia

  • Kernel-Modul — Ein Kernel Modul (kurz „LKM“ für englisch: „loadable kernel module“) ist ein spezielles Computerprogramm, das im laufenden Betrieb in den Kernel eines Betriebssystems geladen und wieder daraus entfernt werden kann. Kernel Module werden häufig für …   Deutsch Wikipedia

  • Module (disambiguation) — Contents 1 Computing and engineering 2 Science and mathematics 3 Music …   Wikipedia

  • Monolithic kernel — Structure of monolithic kernel, microkernel and hybrid kernel based operating systems A monolithic kernel is an operating system architecture where the entire operating system is working in the kernel space and alone as supervisor mode. The… …   Wikipedia

  • Linux kernel — Linux Linux kernel 3.0.0 booting Company / developer Linus Torvalds and thousands …   Wikipedia

  • NetWare Loadable Module — Filename extension .nlm Magic number NetWare Loadable Module Developed by Novell Type of format Executable, Shared library A NetWare Loadable Module (NLM) is a binary code module that can be loaded into …   Wikipedia

  • Device driver — Operating systems Common features …   Wikipedia

  • Загружаемый модуль ядра — (loadable kernel module, LKM)  в информатике  объектный файл, содержащий код, расширяющий возможности ядра операционной системы. Модули используются, чтобы добавить поддержку нового оборудования или файловых систем или для добавления… …   Википедия

Поделиться ссылкой на выделенное

Прямая ссылка:
Нажмите правой клавишей мыши и выберите «Копировать ссылку»