STAPBPF(8)

💖 STAPBPF — systemtap bpf runtime 💖

okay bestie, welcome to stapbpf(8) — it's the BPF back-end of Systemtap, and we're gonna get you comfy with it. section 8 of the System Manager's Manual, if you're keeping score 🎀

---

✨ NAME ✨

stapbpf — systemtap bpf runtime

---

✨ SYNOPSIS ✨

stapbpf [ OPTIONS ] MODULE

---

🦋 DESCRIPTION 🦋

So the stapbpf program is the BPF back-end of the Systemtap tool. It's expecting a bpf-elf file that the front-end stap tool made, and it only makes that when you run stap with --runtime=bpf. that's the vibe, that's the whole deal 💅

Now, why is systemtap split into a front-end and a back-end like this? iconique reason, honestly: it lets you compile a systemtap script on a development machine — one that has all the debugging information needed to actually compile the thing — and then just transfer the resulting shared object over to a production machine that has no development tools and no debugging information installed. no cap, that's the whole point of the split 🫶

Wanna know the version number? Please refer to stappaths(7), or just run one of these bad boys:

$ rpm -q systemtap # (for Fedora/RHEL)
$ apt-get -v systemtap # (for Ubuntu)

---

💅 OPTIONS 💅

stapbpf supports the following options, and that's it. Any other option you throw at it? it's just gonna print you a list of supported options. respectfully declining your custom flags 😌

• -v — Verbose mode. it's giving chatty ✨
• -V — Print the version number and exit. bye 👋
• -w — Suppress warnings from the script. shhh, we don't need that negativity 🙈
• -h — Print help message. the classic.
• -x PID — The _stp_target variable will be set to PID.
• -o FILE — Send output to FILE. into the file it goes 🍓

---

🌸 ARGUMENTS 🌸

• MODULE — the path of a bpf-elf file produced by the front-end stap tool, when you run it with --runtime=bpf. yes, that's the one you have to hand it 💜

---

🌈 EXAMPLES 🌈

Okay here's a super basic little example of how you generate a stapbpf module, step by step, no gatekeeping.

Step one: use stap to compile a script. The stap program will report the name of the resulting module in the current working directory, so look out for it 👀

$ stap --runtime=bpf -p4 -e 'probe begin { printf("Hello World!\n");
exit() }'
stap_28784.bo

Step two: run stapbpf with the pathname to the module as an argument. like this:

$ stapbpf ./stap_28784.bo
Hello World!

And lowkey the best part? If you omit the -p4 option, stap will invoke stapbpf automatically for you. main character energy, it just does it ✨

---

😭 LIMITATIONS 😭

ngl, this runtime is in an early stage of development, and it currently lacks support for a number of features that are available in the default runtime. so manage your expectations a lil bit 🥲

A subset of the following probe points is supported:

begin
end
kernel.*
process.*
timer.*
perf.*
procfs.*

In general, probes based on the kprobes, uprobes, tracepoint and perf infrastructures are supported. See stapprobes(3stap) for more info on the probe points and which tracing infrastructures they're based on 🔍

for loops, foreach loops and while loops are usable only in begin and end probes. and try statements? not supported, bestie, don't even try it 💀

There is limited support for string operations. String variables and literals are limited to 64 characters, except for printf format strings, which are limited to 256 characters. count your letters 📏

A subset of the statistical aggregate functionality is available, with support only for the @count(), @sum(), @avg() extractor functions. that's it, that's the list.

⚠️ The name of the bpf-elf file produced by the front-end stap tool should not be changed. don't rename it, don't touch it, leave it alone 🙅‍♀️

---

👑 SAFETY AND SECURITY 👑

See the stap(1) manual page for additional information on safety and security. stay safe out there 🫶

---

⭐ SEE ALSO ⭐

stap(1), stapprobes(3stap), staprun(8), stapex(3stap)

---

🐛 BUGS 🐛

Found something cursed? Use the Bugzilla link of the project web page or our mailing list: http://sourceware.org/systemtap/, <systemtap@sourceware.org>. we wanna hear it fr fr 💌

---

and that's the whole page, bestie — STAPBPF(8) from the System Manager's Manual, section 8, page name STAPBPF(8) 💖 mwah, go compile something cute 🎀✨