Why Can't I Kill My Process?

Question
Why Can't I Kill My Process?

Answer
This document applies to all AIX versions 4 and 3.
To kill a process
Delivery of signals to a system call
To kill a process
Sometimes it is necessary to eliminate a process entirely. This is the purpose of the kill command. The
syntax of the kill command, which is actually a general purpose process signalling utility, is as follows:
k1 |-s1gha] PT0
The kill command (or kill -1S which is the default signal) sends a SIGTERM signal to a process. This signal
can be trapped, thus ignored by a process.
The kill -9 command sends a SIGKILL command to the process. If the process is currently in USER mode,
this signal cannot be caught or trapped and the process will terminate.
Occasionally, processes will not die even after being sent the kill signal. The majority of such processes fall
into one of the following categories:
Zombies. A process in the zombie state (displayed as Z status in BSD ps displays and as defunct
under System V). A zombie process is one in which all its resources have been freed, but the parent
process's acknowledgment has not occurred. Zombies are always cleared the next time the system is
booted and do not adversely affect system performance.
Processes in kernel mode waiting for unavailable resources.
There are two modes a process can be in, USER mode and KERNEL mode.
The process goes into kernel mode anytime it needs to access system functions via a system call routine.
While in the kernel mode, signals are ignored until the system call exits back to user mode. At that time, any
pending signals are handed to the user process.
If while in kernel mode, the process goes to sleep while waiting on a resource and the resource never
becomes available, the process will never exit kernel mode.
The only way to kill a process that is "ignoring" or "sleeping" in kernel mode is to restart the system.
NOTE: Signals are defined in the /usr/include/signal.h file and the command kill -l may be used to
generate a list of their symbolic names.
Delivery of signals to a system call
The kernel delays the delivery of all signals, including SIGKILL, when starting a system call, device driver,
or other kernel extension. The signal takes effect upon leaving the kernel and returning from the system call.
This happens when the process returns to the user protection domain, just before running the first instruction
at the caller return address.