Linux: is it possible to see only kernel space threads/process?

Question

I know there are two "levels" of programs: User space and kernel space.

My question is: I want to see only kernel programs,or better: programs on kernel space.

Is this approach correct?

ps -ef|grep "\["

root         1     0  0 20:23 ?        00:00:00 init [4]
root         2     0  0 20:23 ?        00:00:00 [kthreadd]
root         3     2  0 20:23 ?        00:00:00 [ksoftirqd/0]
root         5     2  0 20:23 ?        00:00:00 [kworker/0:0H]
root         7     2  0 20:23 ?        00:00:06 [rcu_sched]
root         8     2  0 20:23 ?        00:00:00 [rcu_bh]
root         9     2  0 20:23 ?        00:00:00 [migration/0]
root        10     2  0 20:23 ?        00:00:00 [migration/1]
root        11     2  0 20:23 ?        00:00:00 [ksoftirqd/1]
root        13     2  0 20:23 ?        00:00:00 [kworker/1:0H]
root        14     2  0 20:23 ?        00:00:00 [migration/2]
....

is possible to see kernel space programs? ... Yes! You simply need the correct astronomical filter on your CCD... ;-) — RubberStamp, Dec 15 '17 at 22:27
@steve Kernel space programs are really strictly tangential to modules. Not all modules have processes, and not all processes are modules. — Chris Down, Dec 15 '17 at 23:50
The question is wrong: you want to see kernel processes (or kernel threads, or kernel tasks) not kernel programs.... There is only one program involved: the kernel (and kernel modules are added into the kernel). — Basile Starynkevitch, Dec 16 '17 at 13:26
All process switch into kernel space when they make a syscall — 炸鱼薯条德里克, Sep 15 '19 at 12:08
Good answer on stackoverflow: Identifying kernel threads - turned into bash code: How to identify a thread is a kernel thread or not through bash? — maxschlepzig, Nov 09 '20 at 11:45

telcoM · Accepted Answer · 2017-12-16T12:10:09.760

50

Kernel processes (or "kernel threads") are children of PID 2 (kthreadd), so this might be more accurate:

ps --ppid 2 -p 2 -o uname,pid,ppid,cmd,cls

Add --deselect to invert the selection and see only user-space processes.

(This question was pretty much an exact inverse of this one.)

In 2.4.* and older kernels, this PID 2 convention did not exist yet.

edited Dec 16 '17 at 12:10

answered Dec 15 '17 at 23:29

telcoM

96,466

Is it always true ? See the fourth comment in this question: https://stackoverflow.com/q/12213445/1971003 – Guy Avraham Aug 19 '18 at 12:52
1

It is possible that in early 2.6.* kernels the conversion to the "child of PID 2" convention was not quite complete. As HighKing indicates there, the name of PID 2 had also not fully stabilized to kthreadd by 2.6.18. If you're interested in exact details, go to kernel.org and use the git browser interface to drill down into the early history of kernel/kthread.c file. – telcoM Aug 19 '18 at 13:13

Patrick Mevzek · Answer 2 · 2017-12-16T02:23:00.590

4

Kernel threads do not use RAM at all (or at least are displayed not to use any):

ps -eo cmd,vsize,rss | grep -E ' 0 +0$'

edited Dec 16 '17 at 02:23

answered Dec 15 '17 at 23:32

Patrick Mevzek

3,180

score 1 · Answer 3 · answered Sep 15 '19 at 07:33

If you have tuna installed you can list all kernel threads like this:

$ tuna -U -P
                      thread       ctxt_switches
    pid SCHED_ rtpri affinity voluntary nonvoluntary             cmd 
  2      OTHER     0     0xff       290            1        kthreadd  
  3      OTHER     0     0xff         2            0          rcu_gp  
  4      OTHER     0     0xff         2            0      rcu_par_gp  
  6      OTHER     0        0        13            0 kworker/0:0H-kblockd  
  9      OTHER     0     0xff         2            0    mm_percpu_wq  
  10     OTHER     0        0       448            0     ksoftirqd/0
[..]

Linux: is it possible to see only kernel space threads/process?

3 Answers3