home | list info | list archive | date index | thread index

Re: [OCLUG-Tech] how does "ps" identify that something is a kernel thread?

  • Subject: Re: [OCLUG-Tech] how does "ps" identify that something is a kernel thread?
  • From: "Robert P. J. Day" <rpjday [ at ] crashcourse [ dot ] ca>
  • Date: Sun, 23 Jun 2013 06:15:09 -0400 (EDT)
  BTW, i was asking this as i'm in the process of writing a
comprehensive tutorial on linux kernel threads and this was just
something i was curious about.

On Sat, 22 Jun 2013, Randy MacLeod wrote:

> http://unix.stackexchange.com/questions/22121/what-do-the-brackets-around-processes-mean
> mentioned the man page is useful:
>    Sometimes the process args will be unavailable; when this happens, 
>    ps will instead print the executable name in brackets.  (alias cmd, command).  
> I guess that doesn't really answer what ps is _doing_ so let's see...
> Some other sites suggested that kernel threads can be identified by following the ppid 
> until you get to 1 (init) user thread or 0 kernel.
> looking at the output of:
>   strace -f -o /tmp/ps ps -p 2 u
> wasn't much help and neither was:
>    ltrace -f -o /tmp/lps ps -p 2 u
> so I guess the next step would be to download procps http://procps.sourceforge.net/download.html
> compile it in debug mode and set some breakpoints.
> // Randy

  heh, great minds think alike ... i already downloaded the procps
tarball and was perusing it, but i still haven't nailed the snippet of
code that does the actual recognition of a kernel thread to add those
square brackets.

  i'm aware there are a number of ways to tell, i just haven't located
which particular way is used by "ps". still looking ...



Robert P. J. Day                                 Ottawa, Ontario, CANADA

Twitter:                                       http://twitter.com/rpjday
LinkedIn:                               http://ca.linkedin.com/in/rpjday