Loading...

VONDS ©

Lab 112: Proc Hardware Resources

Back to Lab Index

Inspect how Linux assigns hardware resources by reading /proc views for IRQs, I/O ports, and physical memory maps. Correlate a PCI device to its IRQ line, bound driver, and loaded kernel module.

troubleshooting hardware core

Scenario

A VM’s network performance is inconsistent, and you suspect the NIC is not receiving interrupts as expected. You need a fast way to identify which IRQ line the device is using, verify interrupt counters are changing under load, and confirm the correct driver module is loaded.

Operator context

Use /proc to verify the kernel’s view of resource assignment before changing driver settings, tuning IRQ balancing, or assuming a hardware or hypervisor issue.

Objective

  • Inspect interrupt assignment and counters via /proc/interrupts.
  • Watch interrupt counters change in real time using watch.
  • Locate a target device’s IRQ line using filtering.
  • Survey I/O port allocations via /proc/ioports.
  • Inspect physical memory maps via /proc/iomem.
  • Correlate PCI device output to its driver and loaded module.

Concepts

  • Interrupts as an operational signal: counter movement under load is evidence the device is servicing IRQs.
  • /proc/interrupts for per-CPU interrupt counters and source labels.
  • I/O port reservations via /proc/ioports and how they relate to legacy port I/O versus modern MMIO.
  • Physical address mapping via /proc/iomem for System RAM, reserved regions, and device windows.
  • Correlation workflow: PCI enumeration to kernel driver binding to loaded module (lspci, lsmod).

Walkthrough

Step 1 : Show a snapshot of the first 10 lines of /proc/interrupts.
Command 
head -n 10 /proc/interrupts

This file shows per-CPU interrupt counters and the symbolic name of the interrupt source (often a driver or device). Treat it as baseline evidence for “is the device generating interrupts.” 

# Look for device-related labels (examples):
e1000
ehci_hcd:usb1
Step 2 : Watch interrupt counts update live.
Command 
watch -n 1 -d cat /proc/interrupts

Use this to validate counters move when the device is active. If a NIC is passing traffic but its IRQ counter is flat, that points to driver configuration, MSI/MSI-X, or virtualization interrupt routing issues. 

# Expected behavior:
# The relevant device line increments over time.
Step 3 : Filter for the NIC’s interrupt line.
Command 
grep -i e1000 /proc/interrupts

Filtering provides a quick “which IRQ is this device on” answer. Capture this line in tickets because it ties the device to an IRQ number, interrupt type, and source label. 

# Example shape:
16: ... IO-APIC ... e1000
Step 4 : Inspect I/O port allocations.
Command 
head -n 15 /proc/ioports

This file lists I/O port ranges reserved by subsystems and devices. While modern hardware often uses MMIO instead of port I/O, this view is still useful for spotting resource conflicts and understanding legacy mappings. 

# Look for device ranges (example):
e000-e03f : Intel 82540EM (e1000)
Step 5 : Inspect the physical memory map for System RAM regions.
Command 
grep -i 'System RAM' /proc/iomem | head -n 5

/proc/iomem describes physical address regions and what the kernel believes they are used for. Listing System RAM gives a high-level view of RAM segments, which is useful when correlating firmware reservations, device windows, or platform quirks. 

# Expected output includes ranges labeled:
System RAM
Step 6 : Correlate PCI device to its driver binding.
Command 
lspci -nnk | grep -A2 -i ethernet

This shows which driver is actually bound to the Ethernet device. Use it to avoid guessing module names and to confirm the kernel’s active binding. 

Kernel driver in use: e1000
Step 7 : Confirm the driver’s kernel module is loaded.
Command 
lsmod | grep -E '^e1000(\s|$)'

If the driver is bound, the module should be present unless it is built into the kernel. This is quick evidence the runtime matches what the PCI binding claims. 

# Expected:
e1000

Common breakpoints

Interrupt counters are not changing

If the device line is present but counters stay flat under load, confirm traffic is actually hitting the interface, then validate driver binding with lspci -nnk. Next, review IRQ routing and MSI/MSI-X settings for your platform.

grep filter returns nothing

The label may not match your expected driver name. Search for the device by vendor, interface, or IRQ number, or use lspci -nnk to identify the active driver string to filter on.

Kernel driver in use does not match expectations

If a different driver is bound, verify which device you are looking at and confirm the correct module exists. Capture the full device block from lspci -nnk as ticket evidence.

Module not present in lsmod

The driver may be built into the kernel or the device may not be bound. Confirm binding with lspci -nnk, then validate sysfs driver state and logs if needed.

Cleanup checklist

This lab is read-only. Your cleanup is capturing the IRQ line, counter behavior, and bound driver/module so you can reference it during tuning or escalation.

Commands 
head -n 10 /proc/interrupts
grep -i e1000 /proc/interrupts
watch -n 1 -d cat /proc/interrupts
head -n 15 /proc/ioports
grep -i 'System RAM' /proc/iomem | head -n 5
lspci -nnk | grep -A2 -i ethernet
lsmod | grep -E '^e1000(\s|$)'
Success signal

You can name the IRQ line for the NIC, show counters moving under load, and show the bound kernel driver and loaded module.

Reference

  • head -n 10 /proc/interrupts : Shows a snapshot of interrupt counters and source labels.
    • -n 10 : Prints the first 10 lines.
    • /proc/interrupts : Per-CPU interrupt counters and interrupt source labels.
  • watch -n 1 -d cat /proc/interrupts : Re-runs the interrupts view and highlights counter changes.
    • -n 1 : Refresh every 1 second.
    • -d : Highlight differences between updates.
  • grep -i <pattern> /proc/interrupts : Filters interrupts output to lines matching a device or driver label.
  • head -n 15 /proc/ioports : Shows a snapshot of I/O port range reservations.
    • /proc/ioports : I/O port range reservations for devices and subsystems.
  • grep -i 'System RAM' /proc/iomem | head -n 5 : Shows top System RAM regions from the physical address map.
    • | : Pipes output from the left command into the right command.
    • /proc/iomem : Physical address space map (RAM, device regions, reserved ranges).
  • lspci -nnk : PCI device enumeration with numeric IDs and kernel driver binding details.
    • -n : Shows numeric vendor and device IDs.
    • -k : Displays kernel driver currently bound to the device.
  • lsmod : Lists currently loaded kernel modules.
  • lsmod | grep -E '^<module>(\s|$)' : Confirms whether a specific module is loaded.
    • -E : Enables extended regular expressions.
    • ^<module>(\s|$) : Matches the module name at the start of the line.
    • | : Pipes output from the left command into the right command.
    • grep : Filters lines matching the pattern.