Process Management

Lifecycle Diagram

From clone() to reaped, with every state transition the scheduler may make.

Key Numbers

task_struct: The Heart of It

Every task in the kernel is one giant struct. It's defined in include/linux/sched.h and contains hundreds of fields. The major ones:

struct task_struct {
    unsigned int            __state;        /* TASK_RUNNING, TASK_INTERRUPTIBLE, ... */
    void                    *stack;         /* kernel stack pointer */
    refcount_t              usage;
    int                     prio, static_prio, normal_prio;
    struct sched_entity     se;             /* CFS scheduling entity */
    struct mm_struct        *mm;            /* address space (NULL for kernel threads) */
    pid_t                   pid;            /* the task's PID (really TID) */
    pid_t                   tgid;           /* thread group leader's PID (the "process" PID) */
    struct task_struct __rcu *real_parent;  /* real parent at clone() time */
    struct task_struct __rcu *parent;       /* recipient of SIGCHLD (may differ after PTRACE) */
    struct list_head        children;       /* list of children */
    struct list_head        sibling;        /* link in parent's children list */
    struct task_struct      *group_leader;  /* thread group leader */
    struct files_struct     *files;         /* open file descriptor table */
    struct fs_struct        *fs;            /* CWD, root, umask */
    struct signal_struct    *signal;        /* shared signal handlers */
    struct sighand_struct   *sighand;
    struct nsproxy          *nsproxy;       /* PID/MNT/NET/IPC/UTS/USER namespaces */
    const struct cred __rcu *cred;          /* UID, GID, capabilities */
    char                    comm[TASK_COMM_LEN];  /* 16-byte name */
    /* ... hundreds more fields ... */
};

Notice pid vs tgid. The kernel's pid is what userspace calls a thread ID (gettid()). The kernel's tgid is what userspace calls the process ID (getpid()). All threads in a process share a tgid; their pid differs.

fork, clone, and clone3

Three syscalls, one mechanism. All three end up in the kernel's kernel_clone() function. The differences are in how arguments are passed.

/* fork() — POSIX heritage, no flags */
pid_t pid = fork();
if (pid == 0) { /* child */ }
else if (pid > 0) { /* parent, pid is child's PID */ }

/* clone() — full control over what's shared */
int flags = CLONE_VM | CLONE_FS | CLONE_FILES |
            CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM |
            CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
/* exactly the flags glibc uses for pthread_create() */

/* clone3() — newer struct-based interface, allows CLONE_PIDFD */
struct clone_args args = {
    .flags = CLONE_PIDFD,
    .pidfd = (uint64_t)&pidfd,
    .exit_signal = SIGCHLD,
};
syscall(SYS_clone3, &args, sizeof(args));

Important CLONE_* flags:

• CLONE_VM — share the address space (this makes it a thread)
• CLONE_FILES — share the file descriptor table
• CLONE_FS — share CWD, umask, root
• CLONE_SIGHAND — share signal handlers (must combine with CLONE_VM)
• CLONE_THREAD — make it part of the same thread group (same tgid, share signals)
• CLONE_NEWNS / NEWPID / NEWNET / NEWUSER — new namespace (containers)
• CLONE_PIDFD — allocate a pidfd referring to the child

The Five States You'll Actually See

Zombies, Orphans, and Reaping

When a process exits, its task_struct sticks around in EXIT_ZOMBIE until the parent calls one of the wait() family of syscalls to read the exit code. That's the only way to free the slot.

# See zombies on a system
$ ps -eo pid,ppid,state,comm | awk '$3=="Z"'
  3142  1742 Z [chrome] <defunct>

# Reaping in C
int status;
pid_t kid = waitpid(-1, &status, WNOHANG);   /* non-blocking */
if (kid > 0) {
    if (WIFEXITED(status))   printf("exit %d\n", WEXITSTATUS(status));
    if (WIFSIGNALED(status)) printf("signal %d\n", WTERMSIG(status));
}

# Or just ignore SIGCHLD — kernel auto-reaps
signal(SIGCHLD, SIG_IGN);   /* portable but loses exit status */

Orphans are children whose parent died first. They get re-parented to either (a) the nearest ancestor that called prctl(PR_SET_CHILD_SUBREAPER, 1), or (b) PID 1 (init/systemd) if no subreaper exists. Subreapers are how systemd's service supervisors keep tabs on their entire process tree without making everyone in the tree explicitly aware of them.

/* Become a subreaper for your descendants */
prctl(PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0);

/* Auto-die when parent dies (per-thread, cleared on execve) */
prctl(PR_SET_PDEATHSIG, SIGTERM, 0, 0, 0);

pidfd: PIDs Without the Race

Traditional kill(pid, sig) suffers from a race: between you reading the pid and calling kill, the original process can die and the PID can be reused. pidfd fixes this.

/* Get a pidfd for an existing process */
int pidfd = syscall(SYS_pidfd_open, target_pid, 0);

/* Or get one at clone time (race-free) */
int pidfd;
struct clone_args args = { .flags = CLONE_PIDFD, .pidfd = (uint64_t)&pidfd,
                            .exit_signal = SIGCHLD };
pid_t kid = syscall(SYS_clone3, &args, sizeof(args));

/* Send signal — guaranteed to go to the original process or fail */
syscall(SYS_pidfd_send_signal, pidfd, SIGTERM, NULL, 0);

/* Wait for it to die, with poll/epoll */
struct pollfd pfd = { .fd = pidfd, .events = POLLIN };
poll(&pfd, 1, -1);   /* returns when child exits */

/* Steal an FD from another process (CAP_SYS_PTRACE) */
int their_fd = syscall(SYS_pidfd_getfd, pidfd, 5, 0);

The /proc/<pid>/ Directory

Linux exposes per-process kernel state through procfs. Every running task has a directory under /proc/<pid>/. The same data is available under /proc/<pid>/task/<tid>/ for individual threads.

Tradeoffs

Frequently Asked Questions