[SSE4]

Depends on #129

Problem

Stacks stop at frames that keep the caller's stack pointer in memory. Two kinds are common:

GCC dynamic stack realignment (DRAP). Functions with over-aligned locals (e.g. __m256i) that also
pass arguments on the stack or use VLAs get this prologue:

lea    0x8(%rsp),%r10
and    $-32,%rsp
push   -0x8(%r10)
push   %rbp
mov    %rsp,%rbp
push   %r10

DW_CFA_expression: r6 (rbp) (DW_OP_breg6 (rbp): 0)     rbp = *(rbp)
DW_CFA_def_cfa_expression (DW_OP_breg6 (rbp): -8; DW_OP_deref)     CFA = *(rbp - 8)

This is widespread in GCC-built code. Counting DW_CFA_def_cfa_expression (DW_OP_breg6 (rbp): N; DW_OP_deref)
entries: 259 in Debian's libhs (Hyperscan), 345 in libx265, 4,023 across /usr/bin and
/usr/lib/x86_64-linux-gnu on the test host.

Hand-written OpenSSL perlasm (sha*_block_data_order_avx2 and others):

DW_CFA_def_cfa_expression (DW_OP_breg7 (rsp): 152; DW_OP_deref; DW_OP_plus_uconst: 8)     CFA = *(rsp + 152) + 8

ehframe.cpp already recognized the OpenSSL form as RegisterDerefOffset, but fillRule turned it into
UNWIND_RULE_UNSUPPORTED and the eBPF unwinder had no code for it. The DRAP form was not recognized at
all, and neither was its rbp rule, so even with the CFA fixed the next frame would read a wrong rbp.

Fix

• ehframe.cpp: match *(reg + offset) without a bias as well as with one, and DW_OP_bregN offset
  as a register location, which describes rbp saved at rbp.
• unwindtable: emit UNWIND_RULE_REGISTER_DEREF_OFFSET (bias 0) and
  UNWIND_RULE_REGISTER_DEREF_OFFSET_PLUS_8. struct cfa_unwind_rule has no room for a bias, so it is
  encoded in the kind; other biases stay unsupported. Emit DWARF_UNWIND_RBP_RULE_AT_RBP for rbp saved
  at rbp.
• eBPF: evaluate both deref kinds for rsp and rbp. The CFA comes from memory, so a value that is not
  above the current stack pointer is rejected. Restore rbp from *(rbp) for
  DWARF_UNWIND_RBP_RULE_AT_RBP.
• UNWIND_RULE_REGISTER_DERREF_OFFSET was unused; renamed to fix the typo.

The unwind table layout is unchanged.

Testing

• agent/preprocessing/lib/ut/ehframe_ut.cpp: the OpenSSL, DRAP and glibc (*(rsp + 160)) CFA
  expressions, the rbp location, and expressions that must not match.
• agent/collector/pkg/dso/bpf/unwindtable/manager_test.go: fillRule for both biases, an unsupported
  bias, and the rbp rule.
• Repro below, perforator record -p <pid> -F 999 -d 15s, before and after the change.

Repro

repro-b.c + repro-b-asm.S, gcc -O2 -g -fno-omit-frame-pointer:

repro-b.c
repro-b-asm.S.txt

• main -> drap_caller -> drap_frame -> drap_leaf: drap_frame has a 32-byte aligned local and calls
  drap_leaf with 8 arguments, so GCC emits the DRAP prologue above.
• main -> deref8_caller -> deref8_frame -> deref8_leaf: deref8_frame is assembly with the OpenSSL
  CFI, CFA = *(rsp + 8) + 8.

The callers use frame pointers, so reaching them also checks the restored rbp.

Before	After

	Before	After
DRAP samples reaching main	0%	100%
OpenSSL-style samples reaching main	0%	100%

[robot-magpie]

✅ All contributors are covered under a CLA with Yandex

See CONTRIBUTING.md for more info about Yandex Contributor License Agreement.

---

The following contributors were found:
✅ e2ef2bb Author: @SSE4 (to*****de@gmail.com)

(Only the first commit for a unique contributor is listed)