Linux Kernel Journey

Feb 25, 2025 · Operations

How to Dynamically Trace Kernel Functions with eBPF Using Last Branch Record

Last Branch Record (LBR) is a CPU‑level feature that records branch jumps; the Linux kernel’s bpf_get_branch_snapshot helper (since 5.16) enables eBPF programs to capture LBR data, and the bpflbr tool demonstrates how to trace kernel functions and bpf program execution, disassemble code, and output call stacks.