Function resolve_kernel_sym

src/os/linux/timeline.cpp:44–49

}

VAddr resolve_kernel_sym(const Engine& eng, const char* name) {
    if (auto* s = eng.isf().find_symbol(name)) return s->address;  // KASLR-resilient
    const auto& ks = eng.kallsyms();
    if (ks.ok) for (const auto& s : ks.symbols) if (s.name == name) return s.address;
    return 0;
}

// Wall-clock seconds at boot (UTC), or 0 if not derivable. With it we can
// convert every boot-relative event (process starts, dmesg, eBPF) to absolute