1

I am tasked to implement a simple version of pstree (linux command), while I am confused about the content between what pstree shows and what I find under /proc/[pid] directory. After I type pstree, it shows the root of the whole process tree is systemd, just like this:

systemd─┬─ECAgent───3*[{ECAgent}]
        ├─EasyMonitor
        ├─ModemManager───2*[{ModemManager}]
        ├─NetworkManager─┬─dhclient

While after I try to read all /proc/[pid]/stat files, I got the following result (do a little formatting):

pid  comm       state ppid
1    systemd    S     0
2    kthreadd   S     0
3    rcu_gp     I     2
4    rcu_par_gp I     2

It seems that there is another process kthreadd that is paralleled with systemd. This is different from what shows in pstree command.

After reading some manuals and web materials, I know that pstree displays all runnnig processes and kthreadd is the root thread of all related threads. But I am still confused that kthreadd doesn't count as a running process by pstree command. So it's like kthreadd is not a process even it owns one pid (which is 2)? Should I include kthreadd as a running process in my version of pstree?

Marco Bonelli
  • 63,369
  • 21
  • 118
  • 128
Hantong Liu
  • 555
  • 1
  • 3
  • 12
  • Does this answer your question? [What is kthreadd process and children and how it is different from init and children](https://stackoverflow.com/questions/17988526/what-is-kthreadd-process-and-children-and-how-it-is-different-from-init-and-chil) – Joachim Sauer Feb 26 '20 at 09:35
  • @JoachimSauer Thanks for the hint, I've seen that question before posting mine. That question didn't answer about the `pstree` part. – Hantong Liu Feb 26 '20 at 13:05

1 Answers1

1

kthreadd is not a process started by systemd. Kthreadd is a worker thread in kernel address space started by the kernel.

pstree is more to do with the user space processes that shows the parent and child hierarchy.

In my opinion you should not include kthreadd in your implementation. One of the way to find the kernel threads is /proc/$pid/cmdline is empty for kernel threads.

Maxim Egorushkin
  • 131,725
  • 17
  • 180
  • 271
Bhush
  • 58
  • 10
  • Thanks for the answer, directly responds to my question. So can we say kernel threads are processes, in a broader way? I mean, doesn't `kthreadd` own a PID, which is process id? – Hantong Liu Feb 26 '20 at 13:11
  • Yes, its a process (more specific to Linux kernel, everything is a task!) with pid 2. `2 root 20 0 0 0 0 S 0,0 0,0 0:00.46 kthreadd` – Bhush Mar 03 '21 at 10:17