Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the flow of USB events from kernel space to user space? I get a popup on my desktop when I plug in a USB drive -- what is the sequence of events that leads from detecting the new USB drive to mounting it and showing that popup?

(I know it's a very broad question, but please guide me with some pointers on how to understand the whole idea behind it. I have no problem in browsing large blocks of code if I can be guided correctly.)

share|improve this question

This is handed by udev on modern Linux systems. The udev daemon started with the system will search in /etc/udev/rules.d and /lib/udev/rules.d and will run matching rules for kernel events. Inserting a USB drive will trigger an event, udev will search for a matching rule and will execute it.

The rules themselves will determine what your system does. In recent years, udev has communicated to HAL, which would alert applications via DBUS. This approach is now obsolete in favor of a unified udev solution, which I presume will involve udevd communicating via dbus directly, or via dbus-send.

You can monitor the activities of udev via udevadm monitor.

share|improve this answer

I'm not completely confident with this yet, so take it with a grain of salt and more research.

It starts with the kernel hotplug subsystem. After a device is setup, it either calls whatever userspace program is setup to handle hotplug events (if one was set by echo hotplug_handler > /proc/sys/kernel/hotplug) or sends a data packet over the kobject_uevent netlink socket. When the kernel launches the hotplug handler, it sets up some environment variables. When the kernel sends a datapacket, it includes key=value pairs. If you want to, you can setup a script that just logs the environment and set it up as the handler (not on your production system, of course - a test setup).

Usually, udev is setup as the handler, and it will have several rules setup about how to handle events. From there, it can launch other programs that do other things (like issue dbus messages). These udev rules are highly dependent on the particular distribution of interest.

There is a lot of information in this thread where someone is trying to write some documentation - note the first message is not accurate; keep reading.

share|improve this answer
Once upon a time this was accurate, but not for a long time now: modern udev listens for uevents on a netlink socket. (The old way had serialization/concurrency issues.) – ephemient Jan 11 '11 at 0:06
Since I am new to this part of Linux(udev, hotplug), I would like to have idea on every line you have described here. So could you please elaborate on starts with the kernel hotplug subsystem. – Sen Jan 11 '11 at 4:59
@ephemient: Thanks for the reply. Could you please explain the sequence of events. – Sen Jan 11 '11 at 5:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.