Search code examples
linuxdebugginglinux-kernelgdbptrace

When using GETREGS, does ptrace get only userspace stack RSP, or both kernel and userspace RSP can be possible?

When using ptrace to get the registers of another process, is it possible that the stop point is in kernel space (doing system call or something like in sleep()), that the RIP is in kernel code segment and RSP is the kernel stack pointer?

Solution

  • is it possible ... that the RIP is in kernel code segment and RSP is the kernel stack pointer?

    No, at least not on Linux.