how can i attach Uprobe without symbol

[dtc02040]

i want to attach Uprobe on library with only offset value
ex.Uprobe("", objs.Handle_poll_entry, &link.UprobeOptions{Offset: poll_fp})

https://pkg.go.dev/github.com/cilium/ebpf/link#Executable.Uprobe
there's Note on docs that "Note: Setting the Offset field in the options supersedes the symbol's offset."

but any symbol or none symbol
it just only put error 'attach poll_entry failed: symbol : not found'

can i attach Uprobe without symbol value?

[Strykar]

You need Address, not Offset. Despite the wording on the Uprobe doc ("Setting the Offset field in the options supersedes the symbol's offset"), Offset is always relative. It gets added to either the resolved symbol address or to Address, and cannot bypass symbol lookup on its own.

The decision happens in (ex *Executable).address() in link/uprobe.go:

func (ex *Executable) address(symbol string, address, offset uint64) (uint64, error) {
    if address > 0 {
        return address + offset, nil
    }
    err := ex.lazyLoadSymbols()
    ...
    sym, ok := ex.cachedSymbols[symbol]
    if !ok {
        return 0, fmt.Errorf("symbol %s: %w", symbol, ErrNoSymbol)
    }
    ...
}

With Address > 0 the function returns immediately without touching cachedSymbols, so an empty symbol is fine. Your call sets Offset but leaves Address at zero, so it falls through to the symbol lookup with symbol == "", the lookup misses, and you get symbol : not found.

Fix:

ex.Uprobe("", objs.Handle_poll_entry, &link.UprobeOptions{
    Address: poll_fp,
})

If you also need to attach at poll_fp + some_inner_offset, use both: Address: poll_fp, Offset: 0x10.

The UprobeOptions.Address field doc is the accurate description: "Symbol address. Must be provided in case of external symbols (shared libs). If set, overrides the address eventually parsed from the executable." The function-level note about Offset superseding the symbol's offset is misleading and probably worth a separate docs fix.

[Strykar]

Also opened #2008 to fix the misleading docstring upstream.