I'm doing a research about virtual machines and the rings they are running in. From documentation, this is sometimes hard to find. So I would like to run the VM's and then have a look at the processes and see in which ring they are running.
According to the blog-post of Gustavo Duarte the CPL-Register is set by the processor according to the ring of the process. In here @Stephen Kitt mentioned that there are possibilities. The solution in using gdb returns as mentioned as the register value Ring3. I've tried it with the process like
iwlwifi which I suppose is running in Ring0, but they all returned Ring3 as their cs register content.
The suggested way is to use
ftrace. But this program is seriously complex and I could not find a tutorial. Does somebody know the magic lines to just get the CS of a process?
Is there any other way retrieve the value from the CS register?