uevent sent from kernel to user space (udev)

1. It sends netlink message called uevent. uevent is just string of some special format that is sent via netlink socket. Example:

   "add@/class/input/input9/mouse2\0    // messageACTION=add\0                         // action typeDEVPATH=/class/input/input9/mouse2\0 // path in /sysSUBSYSTEM=input\0                    // subsystem (class)SEQNUM=1064\0                        // sequence numberPHYSDEVPATH=/devices/pci0000:00/0000:00:1d.1/usb2/2­2/2­2:1.0\0  // device path in /sysPHYSDEVBUS=usb\0       // busPHYSDEVDRIVER=usbhid\0 // driverMAJOR=13\0             // major numberMINOR=34\0",           // minor number

   Kernel function that actually sends uevent is kobject_uevent_env and it's wrapper kobject_uevent that is called in many places.

2. Yes, udev works by receiving uevents from netlink socket. But there is an option - kernel can call usermode helper. In this case kernel spawns one process per hotplug event, supplying environment variables to each new process describing that particular hotplug event. If you look at kobject_uevent_env you'll see that netlink message is actually #ifdef'ed and default action is to call that usermode helper

3. In theory netlink messages can be broadcast, multicast and unicast, but kernel sends broadcast message with netlink_broadcast_filtered call. Anyway that message goes to socket of NETLINK_KOBJECT_UEVENT family. You can see netlink socket creation in uevent_net_init.

4. Answering your comment question. You will not see any send function in kernel. send is a system call - it's interface that kernel provides to userspace, but kernel itself does not use any of syscalls. There is a long chain of function calls (in net/netlink/af_netlink.c and net/core/dev.c) from kobject_uevent_env to final sending that doesn't contain any send - in kernel sending skb (socket buffer) is something like placing buffer in queue and then calling scheduler to deliver that buffer and notify userspace that is waiting on syscall recv

Resources:

1. lib/kobject_uevent.c
2. https://www.kernel.org/doc/pending/hotplug.txt - has userspace program that listens for uevents and prints it.
3. https://bootlin.com/doc/legacy/udev/udev.pdf