2

Looking at the proc man page (http://man7.org/linux/man-pages/man5/proc.5.html) it is possible to detect which processes are kernel threads in /proc/<pid>/stat by looking at the flags value (PF_KTHREAD)

flags %u (%lu before Linux 2.6.22)
     (9) The kernel flags word of the process.  For bit
     meanings, see the PF_* defines in the Linux kernel
     source file include/linux/sched.h.  Details depend
     on the kernel version.

This process flag (PF_KTHREAD) doesn't seem to exist in kernel version 2.6.18 (used in RHEL5), the value is used by a different flag.

Is there another method to determine if a pid is a kernel thread?

2 Answers 2

4

Heuristically, see https://stackoverflow.com/questions/12213445/identifying-kernel-threads

ps and top (from procps-3.28) use "no command line" as the check, and have no knowledge of PF_KTHREAD. That is what triggers them to add [``] to the process name, it's not part of the actual process name. Since the command line is under control of the process itself, it's possible that it's been modified.

It depends on how far back (2.4? 2.2?) you need to go. A quick rummage on a few systems indicates no evident common flag (field 9 of /proc/PID/stat)

On late 2.6.x you can mostly guess by the the parent PID being 0 for [kthreadd], that often will have PID 2, and all threads will be its children (init may have PPID=0 too). Or possibly (early 2.6.x?) a [kthread] instead, but not PID 2, but it may only be the parent of most, not all threads.

Another way is to inspect /proc/PID/maps (user space memory map), for a kernel thread this will be empty -- so as long the process flag (in /proc/PID/stat) is not &(PF_EXITING), /proc/PID/maps being empty is a good indicator. Note you must actually read maps, not just stat() it, since the size is misreported as 0; and you must also have permission, if you do not it may appear empty without causing an error.

for pp in /proc/[0-9]*; do 
  if [ -z "$(< $pp/maps)" ]; then echo ${pp##/proc/}; fi; 
done 

You could add a similar expression to check that cmdline is also empty.

1
  • This is perfect. In the function isKernelThread(pid) I just test file length and it seems to be working well. if not len(readProcFile('/proc/%s/maps' % pid)): return True
    – tMC
    Oct 21, 2013 at 14:05
0

Looking in the /proc entry of a kernel thread on a 3.8 series kernel, apparently the exe link is empty, the statm is full of zeroes, the status is missing all the Vm* entries and the maps is empty too.

Maybe some of these apply to the older kernel in question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .