What Are kthread Daemons in Linux?

In Linux, processes enclosed in brackets such as [kthreadd] or [kworker/...] in process monitoring tools are kernel threads. This article explains the purpose of the kthread daemon architecture, how these threads operate exclusively within kernel space, their role in handling asynchronous system tasks like memory swapping and hardware interrupts, and how to identify them in the process table.

The Purpose of Kernel Threads

Kernel threads (kthreads) are background processes created by the Linux kernel to execute kernel code directly. Unlike standard user-space applications (such as a web server or text editor), kernel threads do not run user-space code, do not allocate standard user-space virtual memory, and cannot switch to user mode.

Their primary purpose is to offload and asynchronously process recurring or deferred tasks that the kernel cannot afford to handle synchronously during hardware interrupt handling.

Key Responsibilities

Kernel threads manage several critical operating system functions:

• Deferred Interrupt Handling: When hardware triggers an interrupt, the immediate top-half handler runs quickly. Heavy follow-up processing is delegated to kernel threads like ksoftirqd to prevent system freezes.
• Memory Management: Threads such as kswapd monitor memory utilization and automatically reclaim pages or handle swapping when free memory drops below configured watermarks.
• Asynchronous Workqueues: Threads prefixed with kworker handle generic delayed work items, timers, driver tasks, and input/output flushes.
• Task Scheduling and Migration: Threads like migration/N ensure tasks are balanced across CPU cores in multi-core systems.
• Storage Synchronization: Kernel threads handle writeback operations, committing dirty data cached in RAM to persistent storage devices.

The Role of kthreadd (PID 2)

During the Linux boot sequence, the kernel initializes process ID 1 (systemd or init) for user space and process ID 2 (kthreadd) for kernel space.

The kthreadd daemon serves as the parent process for all subsequent kernel threads. When drivers or kernel subsystems request a new background worker, kthreadd spawns the thread.

How to Identify Kernel Threads

In output from commands like ps aux or top, kernel threads are identified by the following characteristics:

1. Square Brackets: The command or process name is enclosed in brackets (e.g., [kthreadd], [kcompactd0]).
2. Parent Process ID: Their PPID (Parent PID) is typically 2 (kthreadd).
3. Zero Virtual Memory in User Space: In ps output, the VSZ (virtual memory size) or resident user memory often registers as 0 because they borrow address space from existing tasks or operate entirely in kernel memory.

Kernel threads are integral to the stability and operation of the operating system. Because they run core kernel routines, they cannot be terminated or signaled using standard commands like kill -9.