Hi.... On Thu, May 12, 2011 at 17:55, limp <johnkyr83@xxxxxxxxxxx> wrote: > I was wondering if any other CPU register (apart from CR3) can indicate if a > user-process or a kernel thread under it (and which one) is executed. Is it > possible to know such a thing *only* by looking at CPU registers? one thing you can use is by looking at so called CPL (Current Privilege level) and check it whether it is 0. According to http://en.wikipedia.org/wiki/X86_memory_segmentation, CPL is the lower 2 bits in CS. However, you need to watch it continously, because user space apps could switch to CPL=0 (which denotes kernel mode, where CPL=3 denotes user mode) in the case of system call etc. perhaps better is by looking at the address of mm. However, to do this, you need to check starting from its task_struct, which is mapped in its kernel stack in x86 AFAIK. In other arch such as ARM, AFAIK task_struct could be simply derived from certain register. -- regards, Mulyadi Santosa Freelance Linux trainer and consultant blog: the-hydra.blogspot.com training: mulyaditraining.blogspot.com _______________________________________________ Kernelnewbies mailing list Kernelnewbies@xxxxxxxxxxxxxxxxx http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
