Could someone confirm the expressiveness of BPFtrace

What eBPF features/functionalities are and aren’t available in bpftrace?

Because bpftrace is more succinct than BCC or gobpf [1], We are looking to use bpftrace as the language to write custom BPF probes.

One concern is that bpftrace might only support a subset of the powerful features of eBPF. Therefore we’d like a confirmation that bpftrace provides all features of eBPF, or a pointer to the list of things that were not offered yet.

[1] https://github.com/iovisor/gobpf

Hi,

bpf is a fairly complex technology so it’ll be difficult to say exactly what bpftrace can or cannot do w.r.t. bpf as a whole. It would also help if you could clarify what you’re trying to accomplish.

bpftrace is certainly a subset of available kernel features. For example, bpftrace does not currently make use of bpf global data or have the ability to packet filtering. bpftrace’s main goal is succinctness and ease of use. Full parity of bpf features is not really one of bpftrace’s goals. The majority of bpftrace scripts I’ve seen don’t extend past 20-30 lines of code.

If you need the full power of bpf, then it’s recommended you drop down to the Compile-Once-Run-Everywhere (CO-RE) framework. You can read more about that here. One library that enables that is libbpf-rs (disclaimer: I wrote that library). Alternatively, you can use bcc or any of the other frameworks.

1 Like