/proc is a special virtual file system. It does not exist on a physical disk but is dynamically generated by the kernel in memory. Its main purpose is to serve as an interface that allows user-space programs (such as ps, top, htop, etc.) to easily obtain runtime information about the kernel and processes, and in some cases, to dynamically modify kernel parameters.
Therefore, during the Linux driver development process, procfs can often be used as a debugging or dynamic parameter tuning tool.
1. Virtual File System
The files in /proc are not real disk files. When you read them, the kernel calls the corresponding kernel functions to dynamically generate the latest formatted content. When you write to them, the kernel parses the written data and calls the appropriate functions to change the kernel state or parameters. Because it is dynamically generated, it reflects the current state of the system at that moment. Two consecutive reads of the same file (such as /proc/meminfo) may yield different content.
2. Two Main Components
The contents of the /proc directory can be divided into two main categories:
1)Process-related information: Each running process has a subdirectory named after its PID (Process ID) (e.g., /proc/1234). These directories contain detailed information about that process.
2)System-wide information: Other files and directories that are not named with numbers provide information about the entire system, such as CPU, memory, hardware devices, kernel parameters, etc.
3. Files as API Interfaces
Each file in /proc can be viewed as a read-only or read-write API endpoint.
lRead operations: Equivalent to querying information from the kernel.
lWrite operations: Equivalent to sending commands or configurations to the kernel.
The main directories are as follows:
1)Process-related directories (/proc//)
Taking the init process with PID 1 (usually systemd in modern systems) as an example, its directory is /proc/1/.
a)/proc//status: A summary of the process status, including name, state, PID, PPID, memory usage, etc. This is the main source of information for the ps command.
b)/proc//cmdline: The complete command line used to start the process, with parameters separated by null characters (\0). When viewed with cat, it may appear concatenated.
c)/proc//exe: A symbolic link to the program file that the process is currently executing.
d)/proc//cwd: A symbolic link to the current working directory of the process.
e)/proc//fd/: A directory containing symbolic links to all file descriptors opened by the process. Some information for the lsof command comes from here. 0: standard input 1: standard output 2: standard error
f)/proc//environ: The environment variables of the process, separated by null characters. You can conveniently view them using strings /proc//environ.
g)/proc//stat and /proc//statm: Contains a wealth of raw data about the process state (runtime, priority, page fault count, etc.) for tools like ps to parse.
h)/proc//io: I/O statistics for the process, such as the number of characters read/written.
i)/proc//ns/: The various namespaces to which the process belongs, which are the basis for container isolation.
2)System-wide Information
a)/proc/cpuinfo: Detailed information about the CPU, such as model, number of cores, frequency, cache size, etc.
b)/proc/meminfo: Detailed usage of memory and swap space. This is the data source for the free command.
c)/proc/version: Information about the currently running kernel version.
d)/proc/loadavg: The system’s average load (1 minute, 5 minutes, 15 minutes).
e)/proc/uptime: Total time since the system was booted and total time spent in idle processes (in seconds).
f)/proc/filesystems: A list of file systems currently supported by the kernel.
g)/proc/interrupts: A count of interrupts that have occurred on each CPU.
h)/proc/modules: A list of currently loaded kernel modules. This is equivalent to the lsmod command.
i)/proc/mounts: A list of all currently mounted file systems. This is equivalent to the mount command.
j)/proc/net/: A directory containing a wealth of network protocol and statistics files, such as tcp, udp, dev, route, etc. This is the data source for commands like netstat and ss.
k)/proc/devices: A list of loaded block devices and character devices.
l)/proc/sys/: This is the most important configurable part.
m)/proc/sys/ and Kernel Parameter Tuning
n)The files in the /proc/sys/ directory are writable, allowing you to view and modify kernel parameters at runtime. These modifications are usually temporary and will be lost after a system reboot. To make permanent changes, you need to write the settings to the /etc/sysctl.conf file.
3)Common Configuration Examples:
a)/proc/sys/net/ipv4/ip_forward
Function: Controls whether the kernel allows IPv4 packet forwarding (i.e., acts as a router).
Enable: echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
Permanent effect: Add net.ipv4.ip_forward=1 to /etc/sysctl.conf, then execute sysctl -p.
b)/proc/sys/vm/swappiness
Function: Controls how aggressively the kernel swaps memory pages to swap space (value 0-100). The higher the value, the more aggressive.
Reduce swapping: echo 10 | sudo tee /proc/sys/vm/swappiness
c)/proc/sys/kernel/hostname
Function: The system hostname. Modifying it is equivalent to the hostname command.
Modify: echo “new-hostname” | sudo tee /proc/sys/kernel/hostname
The lspci tool is the most common tool for viewing PCIe device information in Linux systems, and its underlying implementation relies on the Linux procfs, specifically the contents of the /proc/bus/pci folder. During Linux system initialization, a scan of the PCIe tree is performed, and the results are placed in /proc/bus/pci. Based on this, the lspci tool has two characteristics:
1)This tool does not depend on kernel modules, unlike conventional PCIe drivers.
2)lspci prints pure software information, which can lead to situations where the PCIe link of an EP device is established, but lspci can still print the device. However, if you continue to execute lspci -x, you will see that the configuration space content is all f.
lspci source code will be analyzed later when time permits.
Although /proc is very powerful, the Linux community is also promoting the use of more structured and clearer interfaces, such as:
sysfs (/sys): Used for managing devices, drivers, modules, etc.
debugfs: A file system provided for kernel debugging information.
cgroupfs (/sys/fs/cgroup): Used for managing control groups (cgroups).