Devices

Devices#

Linux exposes hardware through device nodes in /dev, kernel state in /sys, and runtime info in /proc. Hot-plug events are routed by udev (systemd-udevd), which creates the nodes, applies permissions, and triggers actions. Drivers ship as kernel modules loaded on demand. The catalog of device nodes themselves lives in Filesystem (the /dev section).

Subsystems#

Every kernel device belongs to one or more subsystems, exposed under /sys/class (by function) and /sys/bus (by attachment). The subsystem decides which character or block node appears under /dev, which ioctls work, and which userspace daemon owns the device.

Common device subsystems#

Subsystem

sysfs path

Typical nodes / tools

block

/sys/class/block

/dev/sd*, /dev/nvme* (lsblk)

net

/sys/class/net

eth0, wlp* (ip, ethtool)

tty

/sys/class/tty

/dev/ttyS*, /dev/ttyUSB*

input

/sys/class/input

/dev/input/event* (libinput)

drm

/sys/class/drm

/dev/dri/card* (xrandr, vulkaninfo)

sound

/sys/class/sound

/dev/snd/* (alsa, pipewire)

usb

/sys/bus/usb

lsusb, usbutils

pci

/sys/bus/pci

lspci, setpci

hidraw

/sys/class/hidraw

/dev/hidraw* (raw HID)

iio

/sys/bus/iio

Industrial / sensor devices

power_supply

/sys/class/power_supply

upower, acpi

 
$ ls /sys/class
$ ls /sys/class/block
$ ls /sys/bus/usb/devices
$ readlink -f /sys/class/net/eth0
$ cat /sys/class/net/eth0/address

Inspection#

The first move when something is wrong with hardware is to enumerate what the kernel actually sees. The same set of tools serves whether the operator is auditing a fresh image, chasing a missing device, or characterizing an unfamiliar host.

Tool

Reports

lsblk

Block devices, partitions, mount points

lsblk -f

Filesystem type, label, UUID

blkid

Filesystem labels and UUIDs

lspci

PCI devices (-vv for full detail)

lsusb

USB devices (-v for descriptors)

lscpu

CPU topology, flags, vulnerabilities

lsmem

Online / offline memory blocks

lshw

Composite hardware report

dmidecode

SMBIOS / DMI (BIOS, board, RAM SPD)

hwinfo

openSUSE-derived comprehensive prober

inxi -Fxz

Friendly summary

hdparm -I

ATA disk identification

nvme list

NVMe namespaces

smartctl -a

SMART health for a disk

 
$ lsblk -f
$ lspci -nnk | grep -A2 -i vga
$ lsusb -tv
$ lscpu | grep -E 'Model name|MHz|Vulnerab'
$ sudo dmidecode -t memory | grep -E 'Size|Speed|Type:|Locator'
$ sudo smartctl -a /dev/sda | head -40

Udev#

udev watches the kernel uevent netlink socket and reacts to hot-plug events. It creates and removes device nodes under /dev, sets ownership and permissions, loads firmware, and runs operator-defined actions through rule files in /etc/udev/rules.d/.

Useful udev rule fields#

Field

Purpose

ACTION

add / remove / change

SUBSYSTEM

block, usb, net, …

KERNEL

Kernel-assigned name (sda, ttyUSB0)

ATTR{...}

sysfs attribute (e.g. ATTR{idVendor}=="1d6b")

ENV{...}

Environment variable on the event

NAME

Set node name

SYMLINK+=

Add a stable symlink in /dev

MODE

Permission (0660)

OWNER / GROUP

operator / plugdev

RUN+=

Run a program on the event

A stable symlink for a USB serial adapter.

$ udevadm info -a -n /dev/ttyUSB0 | head -40

$ sudo install -m 0644 /dev/stdin /etc/udev/rules.d/10-ftdi.rules <<'EOF'
$ SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", \
    SYMLINK+="ftdi", MODE="0660", GROUP="dialout"
$ EOF

$ sudo udevadm control --reload
$ sudo udevadm trigger --subsystem-match=tty

Inspect events live.

$ udevadm monitor --udev --property
$ udevadm test /sys/class/net/eth0

Kernel Modules#

Drivers and many kernel features ship as loadable modules rather than being compiled into the kernel image. They are loaded on demand by udev when matching hardware appears, pulled in by another module’s dependency, or loaded explicitly with modprobe.

Tool

What it does

lsmod

List currently loaded modules

modinfo

Show metadata, parameters, dependencies

modprobe

Load (with deps); honors modprobe.d config

insmod

Load a single .ko file (no dependency resolution)

rmmod

Remove a module

depmod

Rebuild modules.dep

dmesg

Kernel messages (driver init and errors)

 
$ lsmod | head
$ modinfo nvme | head -20
$ sudo modprobe -v vfio-pci
$ sudo modprobe -r vfio-pci
$ dmesg --human --follow

$ echo nvme | sudo tee /etc/modules-load.d/nvme.conf
$ echo 'options snd_hda_intel power_save=1' | \
    sudo tee /etc/modprobe.d/snd-power.conf

$ echo 'blacklist nouveau' | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
$ sudo update-initramfs -u

Block Layer#

Above the raw block device sits an optional stack. Partitions, then device-mapper (LUKS, LVM, multipath), then MD RAID, then a filesystem. Each layer is independent, so a single physical disk can carry encryption, logical volumes, and a filesystem all at once.

Block-layer tools#

Tool

Layer

parted

GPT / MBR partitioning (scriptable)

fdisk

MBR partitioning (interactive)

gdisk

GPT partitioning (interactive)

cryptsetup

LUKS / dm-crypt volumes

lvm / vg*

LVM physical volumes, volume groups, logical vols

mdadm

Software RAID

multipath

Multipath I/O over redundant SAN paths

mkfs.*

Create filesystems

fsck.*

Check / repair filesystems

mount / umount

Mount / unmount

losetup

Loop devices (file-backed block devices)

Partition + LUKS + ext4 on a fresh disk.

$ sudo parted -s /dev/sdb mklabel gpt mkpart primary 1MiB 100%
$ sudo cryptsetup luksFormat /dev/sdb1
$ sudo cryptsetup open /dev/sdb1 vault
$ sudo mkfs.ext4 -L vault /dev/mapper/vault
$ sudo mkdir /mnt/vault
$ sudo mount /dev/mapper/vault /mnt/vault

$ lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT,SIZE

Storage Health#

Spinning rust and SSDs both report health via SMART, the on-disk telemetry every modern drive exposes. Run scheduled self-tests with smartctl, and alert on reallocated sectors, pending sectors, and media-wear indicators (the leading signs of imminent failure).

$ sudo smartctl -i /dev/sda
$ sudo smartctl -H /dev/sda
$ sudo smartctl -a /dev/sda
$ sudo smartctl -t short /dev/sda
$ sudo smartctl -t long /dev/sda

$ sudo nvme smart-log /dev/nvme0
$ sudo hdparm -tT /dev/sda

$ sudo systemctl enable --now smartd

Power Management#

Modern kernels run CPUs and devices through governors and idle states, exposed under /sys/devices/system/cpu and /sys/class/power_supply. Pick policy for the workload. performance for throughput, powersave for laptops, schedutil as the modern default.

Tool

Scope

cpupower

CPU frequency / governor (current default)

cpufreq-info

Inspect cpufreq state (legacy)

powertop

Watt-by-watt breakdown + tunables

tlp

Laptop battery / AC profile manager

upower

Battery / AC state queries

acpi

ACPI thermal / battery summary

rfkill

Soft / hard radio kill switches (wifi, BT)

 
$ sudo cpupower frequency-info
$ sudo cpupower frequency-set -g performance
$ sudo powertop --auto-tune
$ tlp-stat -s
$ upower -i $(upower -e | grep BAT)
$ rfkill list

Input, Graphics, Audio#

The desktop-side stacks. evdev for input, KMS / DRM and Wayland or X11 for graphics, ALSA and PipeWire / PulseAudio for sound. Mostly out-of-scope on servers, but useful when triaging an operator’s own workstation or building a kiosk.

Stack

Tools / probes

Input (libinput)

libinput list-devices, libinput debug-events

X11

xinput, xrandr, xev

Wayland

wev, compositor-specific (hyprctl, swaymsg)

DRM / GPU

drm_info, vulkaninfo, glxinfo, nvidia-smi, intel_gpu_top, radeontop

ALSA

aplay -l, alsamixer, arecord -l

PipeWire

pw-cli, pw-top, wpctl status

PulseAudio

pactl list, pacmd

Bluetooth

bluetoothctl, hcitool

 
$ xrandr --listmonitors
$ sudo libinput list-devices | head -30
$ wpctl status
$ bluetoothctl devices

Files & paths#

Configuration that drives module loading, udev, and per-subsystem defaults. These are where the operator makes device behavior persistent across reboots, blacklists a driver, pins an interface name, or grants a USB device to a non-root group.

Kernel modules#

  • /etc/modules. Modules to load at boot (Debian / Ubuntu).

  • /etc/modules-load.d/*.conf. systemd-style, one module per line.

  • /etc/modprobe.d/*.conf. Module options, aliases, blacklists (options snd_hda_intel power_save=1, blacklist nouveau).

  • /lib/modules/$(uname -r)/. Compiled module tree.

  • /lib/modules/$(uname -r)/modules.dep. Dependency map (rebuilt by depmod).

  • /etc/dracut.conf / /etc/initramfs-tools/. Modules baked into the initramfs.

udev#

  • /etc/udev/rules.d/*.rules. Operator rules (highest precedence).

  • /lib/udev/rules.d/*.rules. Distro / package-shipped rules.

  • /run/udev/rules.d/*.rules. Runtime rules.

  • /etc/udev/udev.conf. Daemon defaults.

  • /etc/udev/hwdb.d/*.hwdb. Hardware database fragments (vendor / product strings, key remaps).

Block layer#

  • /etc/fstab. Persistent mount table.

  • /etc/crypttab. LUKS volumes opened at boot.

  • /etc/mdadm/mdadm.conf. Software RAID arrays.

  • /etc/lvm/lvm.conf. LVM defaults.

  • /etc/multipath.conf. Multipath I/O configuration.

Power and CPU#

  • /etc/default/cpufrequtils. Governor selection (Debian).

  • /etc/tlp.conf. TLP power-management profiles (laptops).

  • /sys/devices/system/cpu/cpu*/cpufreq/. Live frequency knobs.

  • /sys/class/power_supply/. Battery, AC adapter state.

Graphics, input, audio#

  • /etc/X11/xorg.conf.d/*.conf. X server device sections.

  • /etc/libinput/ and /usr/share/libinput/. Input device quirks.

  • /etc/asound.conf / ~/.asoundrc. ALSA config.

  • /etc/pipewire/ and ~/.config/pipewire/. PipeWire config.

  • /etc/wireplumber/. WirePlumber session config.

Common Tasks#

Inspect#

What hardware is on this box.

$ lscpu
$ lsblk -f
$ lspci -nnk
$ lsusb -tv

Which removable or external storage is attached.

$ lsblk -o NAME,RM,SIZE,RO,TYPE,MOUNTPOINT,MODEL
$ udevadm info --query=property --name=/dev/sdb
$ ls -la /dev/disk/by-id/ /dev/disk/by-label/

Everything the kernel knows about a single device.

$ udevadm info /dev/<dev>
$ ls -l /sys/block/<dev>/device/
$ sudo smartctl -a /dev/<dev>

What partitions exist on this disk, and how to make a fresh filesystem.

$ lsblk -f /dev/sdb
$ sudo parted /dev/sdb print
$ sudo fdisk -l /dev/sdb
$ sudo mkfs.ext4 -L data /dev/sdb1

Investigate#

Show hot-plug events as they happen.

$ udevadm monitor --environment --udev
$ dmesg -wH
$ journalctl -kf

Is this a VM, a container, or bare metal.

$ systemd-detect-virt
$ sudo dmidecode -s system-manufacturer
$ cat /proc/1/cgroup
$ ls -la /.dockerenv 2>/dev/null

Which USB devices have been plugged in over the last week.

$ journalctl --since '7 days ago' | grep -i usb
$ grep -r '' /var/log/syslog* 2>/dev/null | grep -i 'New USB device'
$ lsusb -v 2>/dev/null | grep -E 'idVendor|idProduct|iSerial'

Is this disk dying.

$ sudo smartctl -H /dev/sda
$ sudo smartctl -a /dev/sda | less
$ sudo smartctl -t short /dev/sda
$ sudo nvme smart-log /dev/nvme0

Where the disk I/O is going.

$ iostat -xz 1 5
$ sudo iotop -boqq -n 3
$ vmstat 1 5
$ cat /proc/diskstats

Modify#

Load, unload, or blacklist a kernel module.

$ lsmod | grep <name>
$ sudo modprobe <module>
$ sudo modprobe -r <module>
$ modinfo <module>
$ echo 'blacklist <module>' | sudo tee /etc/modprobe.d/blacklist-<module>.conf

Warning

Blacklisting a driver that is in the initramfs (storage, crypto, network for NFS root) without rebuilding the initramfs leaves the next boot unable to mount root. Run update-initramfs -u / dracut -f after editing modprobe.d.

Reset or rescan a flaky device without rebooting.

$ sudo udevadm trigger
$ sudo udevadm control --reload-rules
$ echo 1 | sudo tee /sys/block/sdb/device/rescan
$ for h in /sys/class/scsi_host/host*; do echo '- - -' | sudo tee $h/scan; done

References#

  • man 5 sysfs, man 5 proc (kernel-exposed device state).

  • man 7 udev, man 8 udevadm (hot-plug and rule engine).

  • man 8 lsblk, man 8 lspci, man 8 lsusb, man 1 lscpu, man 1 lshw, man 8 dmidecode, man 8 hwinfo (inspection).

  • man 8 modprobe, man 5 modules-load.d, man 5 modprobe.d, man 8 depmod, man 5 modules.dep (kernel modules).

  • man 8 parted, man 8 fdisk, man 8 gdisk, man 8 cryptsetup, man 8 mdadm, man 8 lvm, man 8 multipath, man 5 fstab, man 5 crypttab (block layer).

  • man 8 smartctl, man 8 smartd, man 5 smartd.conf, man 8 nvme, man 8 nvme-smart-log, man 8 hdparm (storage health).

  • man 1 cpupower, man 8 powertop, man 8 tlp, man 1 upower, man 8 rfkill (power management).

  • man 1 xrandr, man 1 xinput, man 1 wpctl, man 1 pactl, man 1 bluetoothctl (input / graphics / audio).

  • Filesystem for /dev, /proc, /sys layout and on-disk filesystems.

  • Hardening for noexec / nosuid / nodev mount options and module-loading lockdown.

  • Services for systemd-udevd, smartd, and other device-touching units.

  • Networking for network-device topics built on these primitives.

  • Linux driver-model docs.

  • systemd udev manual.

Contents