i think eBPF is theoretically faster. eBPF is verified statically while dtrace loads/writes are all checked dynamically.

i guess eBPF verifier is a bit scary because a small bug anywhere in the verifier creates a big hole. i think project zero found a lot of bugs in the verifier.

its pretty scary putting an interpreter in the kernel. i'm not surprised linux didn't want to have two completely different interpreters in there.