DEV Community: Zobair Najdaoui

Understanding the exit status Bits

Zobair Najdaoui — Thu, 22 May 2025 18:14:08 +0000

🔢 Understanding the `status` Bits

This status is a 16-bit integer returned by the kernel to describe how a child process changed state. It can represent:

Normal termination (via exit() or return)
Killed by a signal
Stopped by a signal
Continued (after being stopped)

🧱 Bit Layout for Each Case

Let's read this from least significant bit (bit 0) to most (bit 15):

✅ 1. Normal Termination

Bits 0–7:    Always zero
Bits 8–15:   Exit status (0–255)

So the value looks like:

0x00SS  (where SS is the exit status byte)

Detected by WIFEXITED(status) macro.
WIFSIGNALED(status) → false

☠️ 2. Killed by Signal

Bits 0–6:   Signal number (non-zero)
Bit 7:      Core dump flag
Bits 8–15:  Unused (0)

Example: if the process was killed by SIGSEGV (11) and dumped core:

Signal = 11  → bits 0-6 = 0001011
Core   = 1   → bit 7 = 1

status = 00000000 10001011  → 0x008B

WIFSIGNALED(status) checks that:
- Bits 0–6 ≠ 0 (so signal present)
- Bits 8–15 = 0 (not a stopped or continued signal)
If so → returns true

Then:

WTERMSIG(status) → reads bits 0–6 → 11
WCOREDUMP(status) → reads bit 7

✋ 3. Stopped by Signal

Bits 0–7:   0x7F (decimal 127)
Bits 8–15: Stop signal

Looks like: 0xSS7F where SS = signal
Detected by WIFSTOPPED(status)
WIFSIGNALED(status) → false

▶️ 4. Continued

status = 0xFFFF

Used with waitpid(..., WCONTINUED)
Detected by WIFCONTINUED(status)
WIFSIGNALED(status) → false

✅ Summary

Status Type	Bit Pattern Summary	Detected by	Related Macros
Normal exit	bits 0–7 = 0, bits 8–15 = exit code	`WIFEXITED(status)`	`WEXITSTATUS(status)`
Killed by signal	bits 0–6 = signal, bit 7 = core dump flag	`WIFSIGNALED(status)`	`WTERMSIG(status)`, `WCOREDUMP(status)`
Stopped	bits 0–7 = 0x7F, bits 8–15 = stop signal	`WIFSTOPPED(status)`	`WSTOPSIG(status)`
Continued	status == 0xFFFF	`WIFCONTINUED(status)`

Break down WIFSIGNALED

Zobair Najdaoui — Thu, 22 May 2025 18:04:06 +0000

🧠 Context: What is `status`?

status is an int passed by reference to wait() / waitpid().
When a child process terminates, the kernel writes information about how it terminated into status.
You then use macros like WIFSIGNALED(status) to interpret that information.

🔍 1. `WIFSIGNALED(status)`

"Was the child process terminated by an uncaught signal?"

This macro checks if the child died because of a signal, not because it called exit() or returned from main().
Returns non-zero (true) if:
- The child process ended due to a signal, not normal exit.
- The signal was not caught or ignored, meaning it went unhandled.

💡 Example:

#include <sys/wait.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    pid_t pid = fork();
    if (pid == 0) {
        // Child process: cause segmentation fault
        int *p = NULL;
        *p = 1;  // SIGSEGV
    } else {
        int status;
        waitpid(pid, &status, 0);

        if (WIFSIGNALED(status)) {
            printf("Child was killed by signal %d\n", WTERMSIG(status));

            if (WCOREDUMP(status))
                printf("Core dump was generated\n");
        }
    }
}

🛑 2. `WTERMSIG(status)`

"Which signal caused the termination?"

If WIFSIGNALED(status) is true, you can use WTERMSIG(status) to get the signal number.
For example:
- SIGSEGV = 11 (Segmentation fault)
- SIGKILL = 9
- SIGINT = 2 (CTRL+C)
These signal numbers are defined in <signal.h>.

💾 3. `WCOREDUMP(status)`

"Did the process create a core dump?"

Some systems generate a core dump file when a process crashes due to a signal.
WCOREDUMP(status) checks whether that happened.
It’s not part of the official POSIX (SUSv3) standard, but it’s available on many systems like Linux, BSD, etc.

🧩 How does this work under the hood?

Internally, the status integer returned by wait() contains bit fields that encode:

Whether the process exited normally or by signal
What signal or exit code
Whether a core dump occurred

Macros like WIFSIGNALED just check specific bits in that integer.

🧪 Summary Table

Macro	What it tells you	Only valid when
`WIFSIGNALED(s)`	Process was killed by an uncaught signal	Always
`WTERMSIG(s)`	The signal number that killed it	When `WIFSIGNALED(s)` true
`WCOREDUMP(s)`	If a core dump was produced	When `WIFSIGNALED(s)` true (and supported)