On Tue, 21 Jan 2025 15:13:52 -0800
Eyal Birger [off-list ref] wrote:

Isn't that the case already, or maybe I misunderstood what Jiri wrote [1]:

quoted

On Sun, Jan 19, 2025 at 2:44 AM Jiri Olsa [off-list ref] wrote:
that's correct, uretprobe syscall is installed by kernel to special user
memory map and it can be executed only from there and if process calls it
from another place it receives sigill  

Eyal.

[1] https://lore.kernel.org/lkml/Z4zXlaEMPbiYYlQ8@krava/ (local)

Ah, he did. Thanks I missed that:

that's correct, uretprobe syscall is installed by kernel to special user
memory map and it can be executed only from there and if process calls it
from another place it receives sigill

-- Steve