Parsing Linux Process status T, Z, and X

In the previous article, we introduced the three States of the Linux Process: R, S, and D. Here we will introduce the other three States.

Linux Process status: T (TASK_STOPPED or TASK_TRACED), paused or tracked.

When a SIGSTOP signal is sent to a process, it enters the TASK_STOPPED status because it responds to the signal, unless the process itself is in the TASK_UNINTERRUPTIBLE status and does not respond to the signal ). The same SIGSTOP and SIGKILL signals are mandatory. User processes are not allowed to reset the corresponding signal processing functions through system calls of the signal series .)
Send a SIGCONT signal to the process to restore it from the TASK_STOPPED status to the TASK_RUNNING status.

When a process is being tracked, it is in the special state of TASK_TRACED. "Being tracked" means that the process is paused and is waiting for the process to be tracked to operate on it. For example, in gdb, a breakpoint is placed on the tracked process, and the process is in the TASK_TRACED state when it stops at the breakpoint. At other times, the tracked process is still in the aforementioned state.

For the process itself, the status of TASK_STOPPED is similar to that of TASK_TRACED, indicating that the process is paused.
In the TASK_TRACED state, the protection layer is added to the TASK_STOPPED state. A process in the TASK_TRACED state cannot be awakened when it responds to the SIGCONT signal. You can resume the TASK_RUNNING State only when the debugging process executes the PTRACE_CONT, PTRACE_DETACH, and other operations through the ptrace system parameters.

Linux Process status: Z (TASK_DEAD-EXIT_ZOMBIE), exit, and the process becomes a zombie process.

The process is in the TASK_DEAD status when it exits.

During this exit process, all resources occupied by the process will be recycled, except for the task_struct structure and a few resources. As a result, the process has only such an empty shell as task_struct, so it is called a zombie.
Task_struct is retained because the process exit code and some statistics are saved in task_struct. The parent process may be concerned with this information. For example, in shell, $? The variable stores the exit code of the Last Exit foreground process, which is often used as the judgment condition of the if statement.
Of course, the kernel can also save this information elsewhere and release the task_struct structure to save some space. However, it is more convenient to use the task_struct structure, because the search relationship from pid to task_struct has been established in the kernel, as well as the parent-child relationship between processes. To release task_struct, you need to create a new data structure so that the parent process can find the exit information of its child process.

The parent process can wait for the exit of a child or child process and obtain its exit information through wait system calls such as wait4 and waitid. Then, wait system calls will release the child process's body task_struct.
When a child process exits, the kernel sends a signal to its parent process to notify the parent process to "collect dead ". This signal is SIGCHLD by default, but you can set this signal when creating a sub-process by calling the clone system.

The following code creates an EXIT_ZOMBIE process:

 
 

  
  
#include   
  
  
void main() {  
  
  
if (fork())  
  
  
while(1) sleep(100);  
  
  
} 
 
 

Compile and run the program. ps:

 
 

  
  
kouu@kouu-one:~/test$ ps -ax | grep a\.out  
  
  
10410 pts/0    S+     0:00 ./a.out  
  
  
10411 pts/0    Z+     0:00 [a.out]   
  
  
10413 pts/1    S+     0:00 grep a.out 
 
 

As long as the parent process does not exit, the child process in this zombie state will always exist. So if the parent process exits, who will "collect" the child process "?
When a process exits, it will host all its sub-processes to other processes to make them sub-processes of other processes ). Who is hosting? It may be the next process in the process group that exits the process, if any) or process 1. Therefore, every process and every moment has a parent process. Unless it is a process no. 1.

Process 1, a process whose pid is 1, also known as the init process.
After linux is started, the first user-state process created is the init process. It has two missions:
1. Execute the system initialization script and create a series of processes. They are the children of the init process );
2. Wait for the exit event of its child process in an endless loop and call the waitid system call to complete the "zombie" operation;
The init process is not paused or killed by the kernel ). It is in the TASK_INTERRUPTIBLE status while waiting for the sub-process to exit, while the "zombie" process is in the TASK_RUNNING status.

Linux Process status: X (TASK_DEAD-EXIT_DEAD). The process is about to be destroyed.

The process may not keep its task_struct during exit. For example, is this process a process that has been detach in a multi-threaded program? Thread? See linux thread analysis). Or the parent process explicitly ignores the SIGCHLD signal by setting the handler of the sigchld signal to SIG_IGN. This is posix, although the exit signal of the sub-process can be set to a signal other than SIGCHLD .)
At this point, the process will be placed in the EXIT_DEAD exit state, which means that the next code will immediately release the process completely. Therefore, the EXIT_DEAD status is very short, and it is almost impossible to capture it through the ps command.

Initial Process status

A process is created by using fork series systems call fork, clone, and vfork. the kernel or kernel module can also be created using the kernel_thread function. The functions used to create sub-processes are essentially the same-copy the calling process to obtain the sub-process. You can use option parameters to determine whether resources are shared or private .)
So since the calling process is in the TASK_RUNNING State, if it is not running, how can it be called ?), The sub-process is also in the TASK_RUNNING status by default.
In addition, the CLONE_STOPPED option is also accepted when the system calls clone and kernel function kernel_thread, so that the initial state of the sub-process is set to TASK_STOPPED.

Process status change

After a process is created, its status may change until the process exits. Although there are several process statuses, there are only two directions for Process status change-from TASK_RUNNING to non-TASK_RUNNING, or from non-TASK_RUNNING to TASK_RUNNING.
That is to say, if a process in the TASK_INTERRUPTIBLE State sends a SIGKILL signal, the process will first be awakened to the TASK_RUNNING State), and then return to the SIGKILL signal and exit to the TASK_DEAD State ). It does not exit directly from the TASK_INTERRUPTIBLE status.

A process changes from a non-TASK_RUNNING state to a TASK_RUNNING state, which is implemented by a wake-up operation by another process or interrupt the processing program. Set the status of the wake-up process to TASK_RUNNING and add its task_struct structure to the executable queue of a CPU. The wake-up process will have the opportunity to be scheduled for execution.

The process changes from the TASK_RUNNING status to the non-TASK_RUNNING status, there are two ways:
1. The response signal enters the TASK_STOPED or TASK_DEAD status;
2. Execute the system call to actively enter the TASK_INTERRUPTIBLE status such as nanosleep System Call), or TASK_DEAD status such as exit system call); or because the resources required for executing the system call are not satisfied, the status of TASK_INTERRUPTIBLE or TASK_UNINTERRUPTIBLE is called by the select system ).
Obviously, both cases can only happen when the process is being executed on the CPU.

1. Analysis of Linux Process status: R, S, and D
2. Detailed discussion on Linux User Creation commands
3. Full parsing of Linux File Types
4. Brief Introduction to Linux disk management commands and terminologies
5. Detailed discussion on Linux User Creation commands