What does a question mark `?` in the STAT column of `ps` on MacOS indicate?

Question

When running the command

ps -xo pid,stat,user,time

On MacOS (Monterey; version 12.5), I sometimes get a ? in the STAT column:

  PID STAT USER        TIME
[...] Removed for brevity
72633 S    mbercx   0:00.06
72949 ?s   mbercx   0:00.00
72952 ?    mbercx   0:00.00
74045 S    mbercx  56:17.38

What does it mean to have a ? in the STAT column, i.e. the process state?

Answer 1

It means Unknown state. (which basically should not happen)

Looking at the source code that nohillside pointed to and in other files https://github.com/apple-oss-distributions/adv_cmds/blob/7c10d3f757148b048a743f7d1d71be0153b2381f/ps/print.c#L441

The ? comes from this line in tasks.c together with a comment on how they match the numeric status.

                            /*01234567 */
char    mach_state_table[] = " RUSITH?";

From other googling https://github.com/osquery/osquery/issues/1886#issuecomment-191455988

I see a list of the eight states as

0 Zombie 1 Running 2 Stuck 3 Sleeping 4 Idle 5 Stopped 6 Halted 7 Unknown

The names here seem to match the letters in the ps code.

See @pwncat's answer for a more complete listing from Apple's code in that case from top.

man ps does not include the Halted and Unknown states. Nor does the xnu code for macos 13

Older versions did include a D status from manuals but the OSX 10.0 code has the same constants as current macOS.

Answer 2

On macOS, ps is roughly based on the libtop.c library whose source contains the following function (white-space truncated):

/* Return a pointer to a string representation of a process state. */
const char * libtop_state_str(uint32_t state) {
    const char *strings[] = {
        "zombie",
#define LIBTOP_STATE_ZOMBIE 0
        "running",
#define LIBTOP_STATE_RUN    1
        "stuck",
#define LIBTOP_STATE_STUCK  2
        "sleeping",
#define LIBTOP_STATE_SLEEP  3
        "idle",
#define LIBTOP_STATE_IDLE   4
        "stopped",
#define LIBTOP_STATE_STOP   5
        "halted",
#define LIBTOP_STATE_HALT   6
        "unknown"
#define LIBTOP_STATE_UNKNOWN    7
    };
    assert(LIBTOP_NSTATES == sizeof(strings) / sizeof(char *));
    assert(state <= LIBTOP_STATE_MAX);
    assert(LIBTOP_STATE_MAXLEN >= 8); /* "sleeping" */
    return strings[state];
}

As correctly pointed out in another answer, ps's print.c takes process state symbols from tasks.c where they directly coincide with the state offsets found in libtop.c as shown above.

The last one is unknown, meaning the process state does not fall into any particular category. And the last symbol is a question mark, thus in rare cases you may see it in the STAT column.

Answer 3

It means that the ps command doesn't match the operating system.

The inclusion of a question mark in the state column by the BSD ps command is the result of hitting a default: case in the code where the current process state as reported by the operating system is not one of the states that the code of ps actually understands.

MacOS doesn't use a straight vanilla BSD kernel. Some commands have been modified to work with the kernel differences. Clearly, a modification was missed here.