Which process is associated with process ID 0 (swapper)

Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

When a process make a connection to one server, if the server doesn't
respond, the swapper process (PID 0) will re-send SYN packet
automatically. How can I know which socket/process that re-sent SYN
packet belongs to.

Thanks in advance,
Mikado.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFER6GeNWc9T2Wr2JcRAsOMAJ9uQze/hsDkzMsXUurVFcbKg/XcUQCgi/1H
c5HttDSP5AboaMe5N4FJPno=
=S8U+
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[linux-os (Dick Johnson)]

On Thu, 20 Apr 2006, Mikado wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> When a process make a connection to one server, if the server doesn't
> respond, the swapper process (PID 0) will re-send SYN packet
> automatically. How can I know which socket/process that re-sent SYN
> packet belongs to.
>
> Thanks in advance,
> Mikado.

This must be a trick question. Linux is not VAX/VMS. There is no
swapper process. Check in /proc. Processes start at 1. Even
kernel threads have PIDs greater than 1.

Portions of the kernel networking code operate detached. The code
gets the CPU from a timer queue or from an interrupt. When an
connection is attempted, the process attempting the connection
is either waiting, with its CPU time being used, or put to
sleep, while the timer queue's CPU time is being used. The
SYN/ACK handshake is handled during this time, therefore it
is possible to find who is attempting that connection. Netstat
gets that information from /proc/net and multiple socket
calls.

Cheers,
Dick Johnson
Penguin : Linux version 2.6.16.4 on an i686 machine (5592.89 BogoMips).
Warning : 98.36% of all statistics are fiction, book release in April.
_
\x1a\x04

****************************************************************
The information transmitted in this message is confidential and may be privileged.  Any review, retransmission, dissemination, or other use of this information by persons or entities other than the intended recipient is prohibited.  If you are not the intended recipient, please notify Analogic Corporation immediately - by replying to this message or by sending an email to DeliveryErrors@analogic.com - and destroy all copies of this information, including any attachments, without reading or disclosing them.

Thank you.

Re: Which process is associated with process ID 0 (swapper)

[Mike Galbraith]

On Thu, 2006-04-20 at 11:30 -0400, linux-os (Dick Johnson) wrote:

> This must be a trick question. Linux is not VAX/VMS. There is no
> swapper process. Check in /proc. Processes start at 1. Even
> kernel threads have PIDs greater than 1.

include/linux/init_task.h
        .pgd            = swapper_pg_dir,
        .comm           = "swapper",

You don't make enough nuclear powered kernels :)

	-Mike

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

linux-os (Dick Johnson) wrote:
> This must be a trick question. Linux is not VAX/VMS. There is no
> swapper process. Check in /proc. Processes start at 1. Even
> kernel threads have PIDs greater than 1.

Linux really has swapper process ;)

> Portions of the kernel networking code operate detached. The code
> gets the CPU from a timer queue or from an interrupt. When an
> connection is attempted, the process attempting the connection
> is either waiting, with its CPU time being used, or put to
> sleep, while the timer queue's CPU time is being used. The
> SYN/ACK handshake is handled during this time, therefore it
> is possible to find who is attempting that connection. Netstat
> gets that information from /proc/net and multiple socket
> calls.

I'm writing kernel module that hooks into netfilter code. I can catch
packet's information and its owner process. The first SYN packet of
handshaking belongs to real user-space socket/process. After timeout,
several SYN packets are generated by kernel-space swapper process (PID
0) Is there anyway to find out the relationship between them in
_kernel_space_ (module context).

Thanks,
Mikado.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFER7EQNWc9T2Wr2JcRAkHYAJ9HFfmHjzTRTIDhCPSI12wgWxKAjQCfXh1R
UAeStFg9Wqk+rJJDGr+WI5c=
=lbpv
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[Joshua Hudson]

On 4/20/06, Mikado <mikado4vn@gmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> linux-os (Dick Johnson) wrote:
> > This must be a trick question. Linux is not VAX/VMS. There is no
> > swapper process. Check in /proc. Processes start at 1. Even
> > kernel threads have PIDs greater than 1.
>
> Linux really has swapper process ;)
>
> > Portions of the kernel networking code operate detached. The code
> > gets the CPU from a timer queue or from an interrupt. When an
> > connection is attempted, the process attempting the connection
> > is either waiting, with its CPU time being used, or put to
> > sleep, while the timer queue's CPU time is being used. The
> > SYN/ACK handshake is handled during this time, therefore it
> > is possible to find who is attempting that connection. Netstat
> > gets that information from /proc/net and multiple socket
> > calls.
>
> I'm writing kernel module that hooks into netfilter code. I can catch
> packet's information and its owner process. The first SYN packet of
> handshaking belongs to real user-space socket/process. After timeout,
> several SYN packets are generated by kernel-space swapper process (PID
> 0) Is there anyway to find out the relationship between them in
> _kernel_space_ (module context).
>
I would recommend walking the list of sockets, and see what process(es) own
the socket that is bound to that quad (host IP, port; foreigh IP, port).
A better design might just be to hook connect(), but think hard on that one. If
you do it, your module cannot be removed.

Re: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>Subject: Re: Which process is associated with process ID 0 (swapper)
>
>This must be a trick question. Linux is not VAX/VMS. There is no
>swapper process. Check in /proc. Processes start at 1. Even
>kernel threads have PIDs greater than 1.
>

The initialization code which runs before the first userspace program is 
invoked (usually /sbin/init) could be termed 'process 0'.



Jan Engelhardt
-- 

Re: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>> This must be a trick question. Linux is not VAX/VMS. There is no
>> swapper process. Check in /proc. Processes start at 1. Even
>> kernel threads have PIDs greater than 1.
>
>Linux really has swapper process ;)
>
To be precise, it has more than one.

When you hit an OOPS, the trace [1] might show:
"Pid: 0, comm: swapper Not tainted 2.6.11.6"

Plus you see one of these per CPU [ps aufwwx]:
root       106  0.0  0.0      0     0 ?        S    Apr20   0:04 [kswapd0]

So, a question to the public: what swapper swaps, and what's swapper(as in 
pid 0) in oops, if there's no PID 0?

>I'm writing kernel module that hooks into netfilter code. I can catch
>packet's information and its owner process. The first SYN packet of
>handshaking belongs to real user-space socket/process. After timeout,
>several SYN packets are generated by kernel-space swapper process (PID
>0) Is there anyway to find out the relationship between them in
>_kernel_space_ (module context).
>
Is your code doing it like ipt_owner does?



[1] http://www.ussg.iu.edu/hypermail/linux/kernel/0504.0/0416.html


Jan Engelhardt
-- 

RE: Which process is associated with process ID 0 (swapper)

[Hua Zhong]

> >Linux really has swapper process ;)
> >
> To be precise, it has more than one.
> 
> When you hit an OOPS, the trace [1] might show:
> "Pid: 0, comm: swapper Not tainted 2.6.11.6"
> 
> Plus you see one of these per CPU [ps aufwwx]:
> root       106  0.0  0.0      0     0 ?        S    Apr20   
> 0:04 [kswapd0]
> 
> So, a question to the public: what swapper swaps, and what's 
> swapper(as in pid 0) in oops, if there's no PID 0?

Swapper is the idle process, which swaps nothing. Its name is historic and it doesn't appear in /proc because for_each_process()
skips it.

Kswapd is totally different.

RE: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>
>Swapper is the idle process, which swaps nothing. Its name is historic and it doesn't appear in /proc because for_each_process()
>skips it.
>
Anyone objecting to renaming it?


Jan Engelhardt
-- 

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jan Engelhardt wrote:
>> Swapper is the idle process, which swaps nothing. Its name is historic and it doesn't appear in /proc because for_each_process()
>> skips it.
>>
> Anyone objecting to renaming it?
> 
> 
> Jan Engelhardt

Please focus on my main question. Thank you!

Mikado.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFESBVxNWc9T2Wr2JcRAseYAJ9Fd8/IN9pk/iAYQYc1MXHxt/T9WgCgmFpx
j3wvQBiYBmDjPO1q4Rc8OB8=
=eNTU
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jan Engelhardt wrote:
> Is your code doing it like ipt_owner does?

Something like that. When I receive packet info, I'll take PID by
attracting current->pid
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFESBcTNWc9T2Wr2JcRAuZcAJwKhY0vjUCxLGpqkkWOjBgnxj9MpQCgrxGu
li8yXqS6hFTiRYW2MuCBwxI=
=jfmh
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jan Engelhardt wrote:
> Is your code doing it like ipt_owner does?

It seems that ipt_owner does _not_ support PID match anymore:

In /usr/src/linux/net/ipv4/netfilter/ipt_owner.c:

...
if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
        printk("ipt_owner: pid, sid and command matching "
               "not supported anymore\n");
        return 0;
}
...

My main objective simply works on single-processor machine, I haven't
intend to do it on SMP one.

Mikado.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFESBrONWc9T2Wr2JcRAnSiAJ9oAMtw0zZ0TcmnSXciuHmWry0sXACfT6M1
o86fk6onyQo/CVz9xIwZK1E=
=e9qN
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[Patrick McHardy]

Mikado wrote:
> Jan Engelhardt wrote:
> 
>>>Is your code doing it like ipt_owner does?
> 
> 
> It seems that ipt_owner does _not_ support PID match anymore:

Yes, it was removed for two reasons:

- it used tasklist_lock from bh-context, resulting in deadlocks
- there is no 1:1 mapping between sockets (or packets) and
  processes. If you use corking even a single packet can be
  created in cooperation by multiple processes.

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patrick McHardy wrote:
> - there is no 1:1 mapping between sockets (or packets) and
>   processes. If you use corking even a single packet can be
>   created in cooperation by multiple processes.

Single packet is created by multiple processes? Can you show me some
examples?

Mikado.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFESDZoNWc9T2Wr2JcRAp79AJ0eYjeA63dNZnRQ66eKVYhKU8NtRACfcONb
wmo/IW+Yr7zuCXH09qDjq3I=
=XChU
-----END PGP SIGNATURE-----

Re: Which process is associated with process ID 0 (swapper)

[Bernd Eckenfels]

Mikado <mikado4vn@gmail.com> wrote:
> Single packet is created by multiple processes? Can you show me some
> examples?

cork to combine headers with sendfile content? Well, I dont think those
cases are important :)

Gruss
Bernd

Re: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>>> Swapper is the idle process, which swaps nothing. Its name is historic and it doesn't appear in /proc because for_each_process()
>>> skips it.
>>>
>> Anyone objecting to renaming it?
>
>Please focus on my main question. Thank you!
>
Hey, you're not the only one on this list.



Jan Engelhardt
-- 

Re: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>>>>Is your code doing it like ipt_owner does?
>> 
>> It seems that ipt_owner does _not_ support PID match anymore:
>
>Yes, it was removed for two reasons:
>
>- it used tasklist_lock from bh-context, resulting in deadlocks
>- there is no 1:1 mapping between sockets (or packets) and
>  processes. If you use corking even a single packet can be
>  created in cooperation by multiple processes.
>
Either way, I'd just be happy to match on "who created this socket" (don't 
need "who sends" ATM) without trying to set up SELinux...

Jan Engelhardt
-- 

Re: Which process is associated with process ID 0 (swapper)

[Jan Engelhardt]

>Either way, I'd just be happy to match on "who created this socket" (don't 
>need "who sends" ATM) without trying to set up SELinux...

Which is... what seems remained in ipt_owner :D

Re: Which process is associated with process ID 0 (swapper)

[Mikado]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I found that "Fireflier" acts like ipt_owner. But I haven't tested it
with this "swapper problem"

[1] - http://edwintorok.googlepages.com/fireflier_kernel.html
[2] - http://fireflier.isgeeky.com/wiki/What_is_fireflier
[3] - http://fireflier.isgeeky.com/wiki/Kernel_module
[4] - http://fireflier.isgeeky.com/wiki/Features

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFESPiQNWc9T2Wr2JcRAlPkAKCfZzgQAmWRBcmMJ3fcNQ2KkP2aEQCgu9q4
8gBeU287DTt17l4q+kSq1A4=
=iyjA
-----END PGP SIGNATURE-----