Subject: [PATCH bpf-next 0/3] bpf: Introduce BPF_BRANCH_SNAPSHOT_F_COPY flag for bpf_get_branch_snapshot helper

From: Leon Hwang <[email-masked]>
Date: Fri, 9 Jan 2026 23:34:17 +0800

When the PMU LBR is running in branch-sensitive mode,
'perf_snapshot_branch_stack()' may capture branch entries from the
trampoline entry up to the call site inside a BPF program. These branch
entries are not useful for analyzing the control flow of the tracee.

To eliminate such noise for tracing programs, the branch snapshot should
be taken as early as possible:

* Call 'perf_snapshot_branch_stack()' at the very beginning of the
  trampoline for fentry programs.
* Call 'perf_snapshot_branch_stack()' immediately after invoking the
  tracee for fexit programs.

With this change, LBR snapshots remain meaningful even when multiple BPF
programs execute before the one requesting LBR data.

In addition, more relevant branch entries can be captured on AMD CPUs,
which provide a 16-entry-deep LBR stack.

Testing

The series was tested in a VM configured with LBR enabled:

vmtest --kvm-cpu-args 'host,pmu=on,lbr-fmt=0x5' -k $(make -s image_name) -

Branch records were verified using bpfsnoop [1]:

/path/to/bpfsnoop -k '(l)icmp_rcv' -E 1 -v \
  --kernel-vmlinux /path/to/kernel/vmlinux

For comparison, the following command was used without
BPF_BRANCH_SNAPSHOT_F_COPY:

/path/to/bpfsnoop -k '(l)icmp_rcv' -E 1 -v \
  --force-get-branch-snapshot --kernel-vmlinux /path/to/kernel/vmlinux

Without BPF_BRANCH_SNAPSHOT_F_COPY, no branch records related to the
tracee are captured. With it enabled, 17 branch records from the tracee
are observed.

Detailed verification results are available in the gist [2].

With this series applied, retsnoop [3] can benefit from improved LBR
support when using the '--lbr --fentries' options.

Links:
[1] https://github.com/bpfsnoop/bpfsnoop
[2] https://gist.github.com/Asphaltt/cffdeb4b2f2db4c3c42f91a59109f9e7
[3] https://github.com/anakryiko/retsnoop

Leon Hwang (3):
  bpf, x64: Call perf_snapshot_branch_stack in trampoline
  bpf: Introduce BPF_BRANCH_SNAPSHOT_F_COPY flag for
    bpf_get_branch_snapshot helper
  selftests/bpf: Add BPF_BRANCH_SNAPSHOT_F_COPY test

 arch/x86/net/bpf_jit_comp.c                   | 66 +++++++++++++++++++
 include/linux/bpf.h                           | 18 ++++-
 include/linux/bpf_verifier.h                  |  1 +
 kernel/bpf/verifier.c                         | 30 +++++++++
 kernel/trace/bpf_trace.c                      | 17 ++++-
 .../bpf/prog_tests/get_branch_snapshot.c      | 26 +++++++-
 .../selftests/bpf/progs/get_branch_snapshot.c |  3 +-
 7 files changed, 153 insertions(+), 8 deletions(-)

--
2.52.0