Red Zone - Stack Frame (x86-64)

 https://devblogs.microsoft.com/oldnewthing/20190111-00/?p=100685

https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64

Kernel Threads

• kthreadd (pid = 2) created by kernel (pid = 0) during boot
• kthreadd helps in creating other kernel threads which are required to run periodically/asynchronously
• "ps" shows kernel threads
• Everything under [square bracket] are kernel threads

sw0:FID128:root> ps -eaf

UID        PID  PPID  C STIME TTY          TIME CMD

root         1     0  0 01:21 ?        00:00:00 init [5]

root         2     0  0 01:21 ?        00:00:00 [kthreadd]

root         3     2  0 01:21 ?        00:00:00 [ksoftirqd/0]

root         4     2  0 01:21 ?        00:00:00 [kworker/0:0]

• All calls from user-space to create a new process (including "create_thread" in kthreadd), will end up in do_fork call which internally calls copy_process

Source: https://subscription.packtpub.com/book/application_development/9781785883057/1/ch01lvl1sec13/kernel-threads