如何判断进程是在内核空间还是用户空间？
某些进程，特别是某些守护进程，可以在内核空间或用户空间中运行（有点像用户在正常或超级用户模式下运行）。有没有一种简单的方法可以找出它适用于任何给定的进程（守护进程）？
Some processes, and in particular some daemons, can run in either kernel space or user space (sort of like how a user can run in normal or superuser mode). Is there a simple way to find out which it is for any given process (daemon)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通常（无论如何，在单片内核中），进程可以在用户空间和内核空间中运行，具体取决于它们正在做什么。用户代码将在用户空间中运行，直到需要内核服务，即内核系统调用。然后，程序将引发一个陷阱，将 CPU 切换到保护模式，其中内核代码执行系统调用（例如，读取或写入文件）。完成后，内核切换回用户模式，用户应用程序继续运行。任何时候都是用户进程在运行；它只是根据需要运行用户代码或内核代码。
编辑
至少在Linux上，我认为没有任何方法可以判断仅内核进程是否会下降到用户空间；毕竟，内核可以做任何它想做的事情。但是，您可以使用一些启发式方法来做出有根据的猜测。例如，pmap 会告诉您进程的用户空间内存被映射到什么位置；没有记忆是非常有力的证据（也许无可争议），它是一个核心任务。同样，如果“ps l”中的 VSZ 字段为 0，则表示该任务没有分配用户空间内存。如果你只是想知道此时任务是否在内核中，“ps l”中的 WCHAN 字段会给你一个提示；如果它不是 - ，它在内核中，如果它是 - ，那么它可能在用户空间中，但我不确定这是否也意味着它在内核空间中被抢占。
Typically (in monolithic kernels, anyway), processes can run in both user space and kernel space, depending on what they're doing. The user code will run in user space until it requires kernel services, i.e. a kernel system call. The program will then cause a trap which switches the CPU to protected mode where the kernel code executes the system call (e.g. to read or write a file). Once that is complete, the kernel switches back to user mode and the user application continues running. At all times it is the user process that's running; it's just running user code or kernel code, as appropriate.
EDIT
At least on Linux, I don't think there's any way to tell if a kernel-only process will ever drop to user space; the kernel is allowed to do anything it wants, after all. But, you can use some heuristics to make an educated guess. For example, pmap will tell you what user-space memory is mapped in for the process; no memory is pretty strong evidence (perhaps incontrovertible) that it's a kernel task. In the same way, if the VSZ field in 'ps l' is 0, it means the task has no user-space memory allocated. If you're just interested in whether the task is in the kernel at this moment in time, the WCHAN field in 'ps l' will give you a hint; if it's something other than -, it's in the kernel, if it's -, then it's likely in user space, but I'm not sure if it could also mean that it's just been preempted while in kernel space.
有一些特定于体系结构的寄存器可以告诉您处于哪种模式：-
a) 您可以使用硬件/软件调试器在调试时检查该寄存器的值
例如：手臂和手臂的 CPSR CS for x86
代码段描述符的低两位将确定代码正在执行的当前特权级别
b) 在代码中，您可以使用宏
user_mode(regs)，它内部使用 cpsr 或 cs 寄存器。user_mode(regs) 确定寄存器集是否来自用户模式。
例如：在arm 中，使用cpsr
https://elixir.bootlin。 com/linux/v4.5/source/arch/arm/include/asm/ptrace.h#L20
例如：- 在 x86 中，使用 cs
https://elixir.bootlin。 com/linux/v4.5/source/arch/x86/include/asm/ptrace.h#L106
对于所有其他架构，请检查下面的链接
https://elixir.bootlin.com/linux/v4.5/ident/user_mode< /a>
There are architecture specific registers which can tell which mode you are in:-
a) You can use hw/sw debuggers to check the value of that registers while debugging
e;g: CPSR for arm & CS for x86
The lower two-bits of the code segment descriptor will determine the current privilege level that the code is executing
b) From Code, you can use macro
user_mode(regs)which internally uses cpsr or cs register.user_mode(regs) determines whether a register set came from user mode.
e.g: in arm, cpsr is used
https://elixir.bootlin.com/linux/v4.5/source/arch/arm/include/asm/ptrace.h#L20
e.g:- in x86, cs is used
https://elixir.bootlin.com/linux/v4.5/source/arch/x86/include/asm/ptrace.h#L106
for all other architecture, check below link
https://elixir.bootlin.com/linux/v4.5/ident/user_mode