uevent sent from kernel to user space (udev)

Question

I knew that udev plays on the linux system and it receives uevents sent from the kernel through netlink socket.

However, my questions are:

1. How kernel sends out the event ? It must be something triggered by adding/removing device and then sends out events to udev. How does kernel do this? (Is there any code example I can find? )

2. udev receives these uevents only through netlink socket. This is the only way that udev does it. Is this correct?

3. When uevent is sent out from the kernel, I knew it can do broadcast. However, Can it do unicast?

Thanks for any feedback.

Wapiti

Thanks a lot to your detail answer. One more question, I saw that bind(..) function as well. Is this the function that user space program uses to receive uevent? From your answer, I dont see any send(..) that I was thinking this is what kernel uses to send out the uevent. – Wapiti

Answer 1

1. It sends netlink message called uevent. uevent is just string of some special format that is sent via netlink socket. Example:

    "add@/class/input/input9/mouse2\0    // message
    ACTION=add\0                         // action type
    DEVPATH=/class/input/input9/mouse2\0 // path in /sys
    SUBSYSTEM=input\0                    // subsystem (class)
    SEQNUM=1064\0                        // sequence number
    PHYSDEVPATH=/devices/pci0000:00/0000:00:1d.1/usb2/2­2/2­2:1.0\0  // device path in /sys
    PHYSDEVBUS=usb\0       // bus
    PHYSDEVDRIVER=usbhid\0 // driver
    MAJOR=13\0             // major number
    MINOR=34\0",           // minor number
   

   Kernel function that actually sends uevent is kobject_uevent_env and it's wrapper kobject_uevent that is called in many places.

2. Yes, udev works by receiving uevents from netlink socket. But there is an option - kernel can call usermode helper. In this case kernel spawns one process per hotplug event, supplying environment variables to each new process describing that particular hotplug event. If you look at kobject_uevent_env you'll see that netlink message is actually #ifdef'ed and default action is to call that usermode helper

3. In theory netlink messages can be broadcast, multicast and unicast, but kernel sends broadcast message with netlink_broadcast_filtered call. Anyway that message goes to socket of NETLINK_KOBJECT_UEVENT family. You can see netlink socket creation in uevent_net_init.

4. Answering your comment question. You will not see any send function in kernel. send is a system call - it's interface that kernel provides to userspace, but kernel itself does not use any of syscalls. There is a long chain of function calls (in net/netlink/af_netlink.c and net/core/dev.c) from kobject_uevent_env to final sending that doesn't contain any send - in kernel sending skb (socket buffer) is something like placing buffer in queue and then calling scheduler to deliver that buffer and notify userspace that is waiting on syscall recv

Resources:

1. lib/kobject_uevent.c
2. https://www.kernel.org/doc/pending/hotplug.txt - has userspace program that listens for uevents and prints it.
3. https://bootlin.com/doc/legacy/udev/udev.pdf

Hong

Thanks for your reply. Would you mind to answer one more question which I added in my comment? – Wapiti

Updated with answer on comment's question. – Hong

@AlexDzyoba Note: Your third link (udev.pdf) is broken at the moment. – Gymnastic

@AlexanderDzyoba The second link is also broken kernel.org/doc/pending/hotplug.txt (third one - udev.pdf - works for me though) – Forerunner