ustack user address translation

[brendangregg]

# ./bpftrace -e 'kprobe:sys_read { @who[ustack] = count(); }'
Attaching 1 probe...
^C

@who[
0x7f572d91b230
0x7f572dfc1282
0x652f74656e2f7373
]: 1
@who[
0x7fd85a3da500
0x17ccf70
0x17c20f0
0x80100007ffffff2
[...]

At least some of these should be user symbols, not hex numbers. (Some may be hex numbers for one of three valid reasons: 1) short-lived processes, 2) stripped binaries or lacking debuginfo, 3) JIT functions and a lack of a supplemental /tmp/perf-PID.map file).

From src/bpftrace.cpp:

std::string BPFtrace::resolve_usym(uint64_t addr) const
{
  // TODO
[...]

It can behave like iovisor/bcc, which includes support for supplemental /tmp/perf-PID.map files. Can we call libbcc's bcc_resolve_symname() or bcc_symcache_resolve() etc to do it?