{"record":{"id":"4951381d2017a44e","repo":"go-delve/delve","slug":"no-ebpf-program-loaded","errorCode":null,"errorMessage":"no eBPF program loaded","messagePattern":"no eBPF program loaded","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/internal/ebpf/helpers.go","lineNumber":190,"sourceCode":"\t}\n\tctx.m.Unlock()\n\n\tif ctx.bpfRingBuf != nil {\n\t\tctx.bpfRingBuf.Close()\n\t}\n\n\tfor _, l := range ctx.links {\n\t\tl.Close()\n\t}\n\n\tif ctx.objs != nil {\n\t\tctx.objs.Close()\n\t}\n}\n\nfunc (ctx *EBPFContext) AttachUprobe(pid int, name string, offset uint64) error {\n\tif ctx.executable == nil {\n\t\treturn errors.New(\"no eBPF program loaded\")\n\t}\n\tl, err := ctx.executable.Uprobe(name, ctx.objs.tracePrograms.UprobeDlvTrace, &link.UprobeOptions{PID: pid, Address: offset})\n\tctx.links = append(ctx.links, l)\n\treturn err\n}\n\nfunc (ctx *EBPFContext) UpdateArgMap(key uint64, goidOffset int64, args []UProbeArgMap, gAddrOffset uint64, isret bool) error {\n\tif ctx.bpfArgMap == nil {\n\t\treturn errors.New(\"eBPF map not loaded\")\n\t}\n\n\t// Store DWARF types and parameter names for later lookup during ring buffer\n\t// event parsing. Uses a global index: input params at 0..n-1, return params\n\t// at n..n+m-1. Held under ctx.m to prevent data race with pollEvents.\n\tctx.m.Lock()\n\tif !isret {\n\t\tctx.nInputParams[key] = len(args)\n\t}","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/internal/ebpf/helpers.go#L172-L208","documentation":"EBPFContext.AttachUprobe requires a loaded eBPF object (the compiled trace.bpf.o programs loaded into the kernel). If ctx.executable is nil — meaning InitializeEBPF never completed or the program failed to load — attaching a uprobe to trace a function is impossible and this error is returned.","triggerScenarios":"Calling AttachUprobe on a non-linux build with ebpf enabled but program load failed, or after InitializeEBPF failed to load the eBPF object (missing privileges, unsupported kernel, missing compiled object) and the context was still used.","commonSituations":"Running 'dlv trace --ebpf' on a kernel older than required or without CAP_BPF/CAP_PERFMON/CAP_SYS_RESOURCE; kernel without eBPF (CONFIG_BPF_SYSCALL off); missing/upgraded kernel invalidating the embedded .o; running inside restricted containers/seccomp.","solutions":["Run Delve with the required privileges (sudo / CAP_BPF, CAP_PERFMON, CAP_SYS_RESOURCE)","Check kernel version and that BPF syscall is enabled (CONFIG_BPF_SYSCALL, CONFIG_KPROBE_EVENTS/UPROBE_EVENTS)","Verify the eBPF object for your arch was built (make build-ebpf-object) and matches the kernel","Fall back to non-eBPF tracing (dlv trace without --ebpf) if the environment cannot support it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before enabling --ebpf, check privileges and kernel support:\nif _, err := os.Stat(\"/sys/kernel/debug/tracing/uprobe_events\"); err != nil {\n    return errors.New(\"uprobe support missing; use non-eBPF tracing\")\n}\n// and run with CAP_BPF/CAP_PERFMON (e.g. sudo setcap or run under sudo)","typeGuard":null,"tryCatchPattern":"if err := ebpfCtx.AttachUprobe(pid, \"main.foo\", off); err != nil {\n    if strings.Contains(err.Error(), \"no eBPF program loaded\") {\n        log.Printf(\"eBPF init failed; falling back to standard tracepoints: %v\", err)\n        useRegularTrace()\n    }\n}","preventionTips":["Run with the required capabilities (CAP_BPF, CAP_PERFMON, CAP_SYS_RESOURCE)","Confirm kernel version/BPF syscall support before choosing --ebpf","Build the eBPF object for your arch (make build-ebpf-object) and check init logs","Always implement a fallback to non-eBPF tracing"],"tags":["ebpf","linux","uprobes","initialization"],"backgroundTag":"ebpf-program-not-loaded","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}