Linux - /dev and udev

In some Unix-like systems, most device files are managed as part of a virtual file system traditionally mounted at /dev.

Devices

Normal Disks (/dev/hda1)

By convention:

• /dev/hd{x}: IDE controllers devices. E.g. /dev/hda, /dev/hdb, /dev/hdc.
• /dev/sd{x}: SCSI and SATA controllers devices. (Hard disk and SATA SSD) E.g. /dev/sda, /dev/sdb, /dev/sdc.
• /dev/nvme{disk}n{namespace}p{partition}: NVMe SSD. E.g. /dev/nvme0n1p6 equivalent to /dev/sda6.

Configurable: The device names are determined by the udev configuration /lib/udev/rules.d/60-persistent-storage.rules.

Diskless instances: use local ram (tmpfs) or remote HDD / SSD (accessible via iscsi).

Network Block Device (/dev/nb0)

Every time the client computer wants to read, e.g., /dev/nb0, it sends a request over TCP to the server, which will reply with the data read.

This can be used for stations with low disk space (or even diskless) to borrow disk space from another computer.

Unlike NFS, it is possible to put any filesystem on it, etc. It should even be possible to use NBD as a root filesystem, but it requires a user-level program to be in the initrd to start. It also allows you to run block-device in user land (making server and client physically the same computer, communicating using loopback).

Loopback (/dev/loop1)

/dev/loop* are loop devices making plain files accessible as block devices (virtual devices to mount image files).

Loopback device: a virtual device that can be used like any other media device. The loopback filesystem associates a file on another filesystem as a complete device.

E.g. Ubuntu Snaps.

LVM / Device Mapper (/dev/mapper)

device-mapper: map physical block devices (like hard drives, SSDs, partitions) onto higher-level virtual block devices.

Logical Volumes are "dynamic partitions", i.e. they can be created / resized / deleted while the Linux system is running.

Logical Volume Manager (LVM) is a device mapper framework; can have their root file systems on a logical volume.

device-mapper is in the kernel, LVM2 tools are in the userspace.

The device mapper is a framework provided by the Linux kernel for mapping physical block devices onto higher-level virtual block devices. It forms the foundation of the logical volume manager (LVM), software RAIDs and dm-crypt disk encryption, and offers additional features such as file system snapshots.

The entries in /dev/mapper are LVM logical volumes. You can think of these as Linux's native partition type. Linux can also use other partition types, such as PC (MBR or GPT) partitions.

Note that the Linux device mapper is used for other things besides LVM (such as dm-crypt disk encryption), so files in /dev/mapper aren't necessarily LVM logical volumes.

Other features:

• Logical Volumes can extend over more than one disk.
• Can create snapshots and revert to a previous snapshot.

E.g.

• /dev/mapper/crypt_dev_sda3 mapped to /dev/dm-0
• /dev/mapper/linux-root mapped to /dev/dm-1
• /dev/mapper/linux-swap mapped to /dev/dm-2

Ramdisk (e.g. /dev/ram0)

Ramdisk: is a block of random-access memory (primary storage or volatile memory) that a computer's software is treating as if the memory were a disk drive.

The device does not refer to any physical hardware, but to a portion of memory that is set aside for the purpose.

/boot/efi

The /boot/efi system partition is simply the boot partition created when the computers mother board runs UEFI rather than BIOS.

Controlling daemon

Monitors hardware addition and removal at run time, making corresponding changes to the device file system

• BSD: devfs, in kernel space
• Linux: udev, in user space

Check by df:

Linux:

Filesystem ... Mounted on
udev       ... /dev

BSD:

Filesystem ... Mounted on
devfs          /dev

Mount / Umount

Unix systems have a single directory tree. Mounting is the act of associating a storage device to a particular location in the directory tree, which makes a filesystem available to the system.

What is udev?

udev = userspace /dev: /dev used to be static, udev is for plugable devices running in userspace.

To be able to deal with peripheral devices that are hotplug-capable in a user-friendly way, a part of handling all of these hotplug-capable hardware devices was handed over from the kernel to a daemon running in user-space. Running in user space serves security and stability purposes.

udev primarily manages device nodes in the /dev directory. Unlike traditional Unix systems, where the device nodes in the /dev directory have been a static set of files, the Linux udev device manager dynamically provides only the nodes for the devices actually present on a system.

$ ps -e | grep udevd
    304 ?        00:00:00 systemd-udevd

udev is event driven: udev handles all user space events raised when hardware devices are added into the system or removed from it, including firmware loading as required by certain devices.

What does it mean "a device is open" in linux?

In Linux, the phrase "a device is open" stems from the philosophy that "Everything is a file."

When you want to interact with hardware (like a hard drive, a keyboard, or a serial port), Linux represents that hardware as a special file located in the /dev directory.

The Connection: User Space to Kernel Space

When a program (like a media player or a database) wants to use a piece of hardware, it issues an open() system call to the Linux kernel.

• The Request: The program says, "I want to access /dev/sda (a hard drive)."
• The Handle: If the kernel allows it, it returns a File Descriptor (FD)—a small integer (like 3 or 4).
• The Result: For the rest of the session, the program doesn't talk to the hardware directly; it talks to that File Descriptor.

What the Kernel Does Internally

When a device is opened, the Linux kernel performs several background tasks:

• Permission Check: It checks if the user has the rights (read/write) to access that specific hardware.
• Driver Initialization: The kernel looks at the device's "Major and Minor numbers" to figure out which Device Driver controls it. It then tells that driver to prepare the hardware for use (e.g., spinning up a disk or resetting a serial port).
• Reference Counting: The kernel keeps a counter of how many processes have that device open. As long as the count is above zero, the device is considered "in use."

Types of "Open" Behavior

The meaning of "open" changes slightly depending on the type of device:

• Character Devices (e.g., /dev/ttyUSB0, /dev/mouse): These are usually data streams. Often, only one program can open these at a time (Exclusive Access). If a second program tries to open it, it might get an "External device busy" error.
• Block Devices (e.g., /dev/nvme0n1, /dev/sdb): These represent storage. While multiple programs can open a block device file, usually only the OS kernel "opens" it to mount a filesystem.

Practical Implications: Why it matters

If a device is "open," it leads to several common Linux scenarios:

• "Device or Resource Busy": You cannot unmount a USB drive if a file on it is "open" in a terminal or a text editor. The kernel prevents unmounting to avoid data corruption.
• Persistence: If a program crashes without "closing" the device, the kernel usually cleans it up. However, if the program stays running in the background, the device remains "open" and may be unavailable to other programs.
• Power Management: Modern kernels may prevent a device from entering a low-power "sleep" mode if a process has an open file descriptor to it.

How to see what is "open"

If you want to see which programs have a specific device open, you use the lsof (List Open Files) command:

# Example: See what is using the first hard drive
sudo lsof /dev/sda

# Example: See what is using the sound card
sudo lsof /dev/snd/*

Example: /dev/kvm

/dev/kvm is a perfect example to demonstrate that "opening a device" in Linux isn't always about hardware like a disk or a keyboard; sometimes it is about accessing special CPU features (Virtualization).

Read details: KVM