What is the flow of USB events from kernel space to user space? I get a popup on my desktop when I plug in a USB drive -- what is the sequence of events that leads from detecting the new USB drive to mounting it and showing that popup?
This is handed by
udev on modern Linux systems. The
udev daemon started with the system will search in
/lib/udev/rules.d and will run matching rules for kernel events. Inserting a USB drive will trigger an event,
udev will search for a matching rule and will execute it.
The rules themselves will determine what your system does. In recent years,
udev has communicated to HAL, which would alert applications via DBUS. This approach is now obsolete in favor of a unified
udev solution, which I presume will involve
udevd communicating via
dbus directly, or via dbus-send.
You can monitor the activities of
I'm not completely confident with this yet, so take it with a grain of salt and more research.
It starts with the kernel hotplug subsystem. After a device is setup, it either calls whatever userspace program is setup to handle hotplug events (if one was set by
echo hotplug_handler > /proc/sys/kernel/hotplug) or sends a data packet over the kobject_uevent netlink socket. When the kernel launches the hotplug handler, it sets up some environment variables. When the kernel sends a datapacket, it includes key=value pairs. If you want to, you can setup a script that just logs the environment and set it up as the handler (not on your production system, of course - a test setup).
Usually, udev is setup as the handler, and it will have several rules setup about how to handle events. From there, it can launch other programs that do other things (like issue dbus messages). These udev rules are highly dependent on the particular distribution of interest.
There is a lot of information in this thread where someone is trying to write some documentation - note the first message is not accurate; keep reading.