standard ps output identifies kernel threads by putting them in
square brackets, as in:
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Jun21 ? 00:00:01 /sbin/init
root 2 0 0 Jun21 ? 00:00:00 [kthreadd]
root 3 2 0 Jun21 ? 00:00:39 [ksoftirqd/0]
root 5 2 0 Jun21 ? 00:00:00 [kworker/0:0H]
root 7 2 0 Jun21 ? 00:00:10 [migration/0]
root 8 2 0 Jun21 ? 00:00:00 [rcu_bh]
root 9 2 0 Jun21 ? 00:06:52 [rcu_sched]
... snip ...
but what *exactly* does the ps command test to see if a task is a
kernel thread? i'm poking through the code for ps right now and it's
not obvious.
it so happens that the parent [kthreadd] always has PID 2, and all
subsequent kernel threads have a PPID of 2, so maybe it's that simple.
or is it checking some field in the task struct? anyone?
rday
--
========================================================================
Robert P. J. Day Ottawa, Ontario, CANADA
http://crashcourse.ca
Twitter: http://twitter.com/rpjday
LinkedIn: http://ca.linkedin.com/in/rpjday
========================================================================