uevent sent from kernel to user space (udev)

Question

I knew that udev plays on the linux system and it receives uevents sent from the kernel through netlink socket.

However, my questions are:

1. How kernel sends out the event ? It must be something triggered by adding/removing device and then sends out events to udev. How does kernel do this? (Is there any code example I can find? )

2. udev receives these uevents only through netlink socket. This is the only way that udev does it. Is this correct?

3. When uevent is sent out from the kernel, I knew it can do broadcast. However, Can it do unicast?

Thanks for any feedback.

Answer 1

1. It sends netlink message called uevent. uevent is just string of some special format that is sent via netlink socket. Example:

   "add@/class/input/input9/mouse2\0    // message
   ACTION=add\0                         // action type
   DEVPATH=/class/input/input9/mouse2\0 // path in /sys
   SUBSYSTEM=input\0                    // subsystem (class)
   SEQNUM=1064\0                        // sequence number
   PHYSDEVPATH=/devices/pci0000:00/0000:00:1d.1/usb2/2­2/2­2:1.0\0  // device path in /sys
   PHYSDEVBUS=usb\0       // bus
   PHYSDEVDRIVER=usbhid\0 // driver
   MAJOR=13\0             // major number
   MINOR=34\0",           // minor number
   

   Kernel function that actually sends uevent is kobject_uevent_env and it's wrapper kobject_uevent that is called in many places.

2. Yes, udev works by receiving uevents from netlink socket. But there is an option - kernel can call usermode helper. In this case kernel spawns one process per hotplug event, supplying environment variables to each new process describing that particular hotplug event. If you look at kobject_uevent_env you'll see that netlink message is actually #ifdef'ed and default action is to call that usermode helper

3. In theory netlink messages can be broadcast, multicast and unicast, but kernel sends broadcast message with netlink_broadcast_filtered call. Anyway that message goes to socket of NETLINK_KOBJECT_UEVENT family. You can see netlink socket creation in uevent_net_init.

4. Answering your comment question. You will not see any send function in kernel. send is a system call - it's interface that kernel provides to userspace, but kernel itself does not use any of syscalls. There is a long chain of function calls (in net/netlink/af_netlink.c and net/core/dev.c) from kobject_uevent_env to final sending that doesn't contain any send - in kernel sending skb (socket buffer) is something like placing buffer in queue and then calling scheduler to deliver that buffer and notify userspace that is waiting on syscall recv

Resources:

1. lib/kobject_uevent.c
2. https://www.kernel.org/doc/pending/hotplug.txt - has userspace program that listens for uevents and prints it.
3. https://bootlin.com/doc/legacy/udev/udev.pdf